danabot | 9d7423f987c3277f9f3babd60b6c0ad8e0edbf64c8ef4902d5578a686c51bb43 | Triage

Submit
Reports

Overview

overview

Static

static

dridex

windows10-2004-x64

Sharing

General

Target

9d7423f987c3277f9f3babd60b6c0ad8e0edbf64c8ef4902d5578a686c51bb43
Size

214KB
Sample

221218-p375caeh2w
MD5

3c134a8fcade6812f2ca56e4cdca71f6
SHA1

9a4d60da544803bdf0b1e4114fe8c2b775eb5ef7
SHA256

9d7423f987c3277f9f3babd60b6c0ad8e0edbf64c8ef4902d5578a686c51bb43
SHA512

11b73494eafdb8a66afe9c7d6f894001e6898985ef9d0db85c8ac431ced740d3ab11aa19d88a0a6ec807b19318db01a34d1fe816b621c003aec6b9b5ce8e6c33
SSDEEP

3072:gjD8TL+RDlRnjNxLVoSEylYeA6/g3u27NgybHOil3lk025PH:GqLYDjJfE56I+27NPbjlVklPH

Score

10^/10

danabot smokeloader backdoor banker trojan

Static task

static1

Behavioral task

behavioral1

Sample

9d7423f987c3277f9f3babd60b6c0ad8e0edbf64c8ef4902d5578a686c51bb43.exe

Resource

win10v2004-20220812-en

danabot smokeloader backdoor banker trojan

windows10-2004-x64

22 signatures

150 seconds

Malware Config

Extracted

Family

danabot

C2

23.236.181.126:443

123.253.35.251:443

66.85.173.3:443

Attributes

embedded_hash
8F56CD73F6B5CD5D7B17B0BA61E70A82
type
loader

Targets

- Target
  
  9d7423f987c3277f9f3babd60b6c0ad8e0edbf64c8ef4902d5578a686c51bb43
- Size
  
  214KB
- MD5
  
  3c134a8fcade6812f2ca56e4cdca71f6
- SHA1
  
  9a4d60da544803bdf0b1e4114fe8c2b775eb5ef7
- SHA256
  
  9d7423f987c3277f9f3babd60b6c0ad8e0edbf64c8ef4902d5578a686c51bb43
- SHA512
  
  11b73494eafdb8a66afe9c7d6f894001e6898985ef9d0db85c8ac431ced740d3ab11aa19d88a0a6ec807b19318db01a34d1fe816b621c003aec6b9b5ce8e6c33
- SSDEEP
  
  3072:gjD8TL+RDlRnjNxLVoSEylYeA6/g3u27NgybHOil3lk025PH:GqLYDjJfE56I+27NPbjlVklPH
Score

10^/10

danabot smokeloader backdoor banker trojan
- Danabot
  Danabot is a modular banking Trojan that has been linked with other malware.
  trojan banker danabot
- Detects Smokeloader packer
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

danabotsmokeloaderbackdoorbankertrojan

© 2018-2024

Terms | Privacy