danabot | 76c6308983a25e53df5148feb115549d75da348164961d866729680e76e45d02 | Triage

Submit
Reports

Overview

overview

Static

static

dridex

windows10-2004-x64

Sharing

General

Target

76c6308983a25e53df5148feb115549d75da348164961d866729680e76e45d02
Size

213KB
Sample

221218-pqzx7seg5x
MD5

2b16fc7243562a5b5d95a5253a537e1b
SHA1

a09e0b91b744cca0ca25fb43d946f8a307d6f9c8
SHA256

76c6308983a25e53df5148feb115549d75da348164961d866729680e76e45d02
SHA512

02656d2e574656d39e71897689627839a972e7f93cb688fbce1a3472bade734aff64a30ff6ebfe70c688aa71ad30b825645c74ee9b6dea7fb75f0caf26f49777
SSDEEP

3072:H4zavlqLVsRwkSTb65ApiiZdkBr30YhHg3utG0wogtfTHOil3lk025PH:YzIqLVtkx5mjdkN0AA+5gtbjlVklPH

Score

10^/10

danabot smokeloader backdoor banker trojan

Static task

static1

Behavioral task

behavioral1

Sample

76c6308983a25e53df5148feb115549d75da348164961d866729680e76e45d02.exe

Resource

win10v2004-20221111-en

danabot smokeloader backdoor banker trojan

windows10-2004-x64

22 signatures

150 seconds

Malware Config

Extracted

Family

danabot

C2

23.236.181.126:443

123.253.35.251:443

66.85.173.3:443

Attributes

embedded_hash
273C0A0F8F7453BAC0E4334012B587B0
type
loader

Targets

- Target
  
  76c6308983a25e53df5148feb115549d75da348164961d866729680e76e45d02
- Size
  
  213KB
- MD5
  
  2b16fc7243562a5b5d95a5253a537e1b
- SHA1
  
  a09e0b91b744cca0ca25fb43d946f8a307d6f9c8
- SHA256
  
  76c6308983a25e53df5148feb115549d75da348164961d866729680e76e45d02
- SHA512
  
  02656d2e574656d39e71897689627839a972e7f93cb688fbce1a3472bade734aff64a30ff6ebfe70c688aa71ad30b825645c74ee9b6dea7fb75f0caf26f49777
- SSDEEP
  
  3072:H4zavlqLVsRwkSTb65ApiiZdkBr30YhHg3utG0wogtfTHOil3lk025PH:YzIqLVtkx5mjdkN0AA+5gtbjlVklPH
Score

10^/10

danabot smokeloader backdoor banker trojan
- Danabot
  Danabot is a modular banking Trojan that has been linked with other malware.
  trojan banker danabot
- Detects Smokeloader packer
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

danabotsmokeloaderbackdoorbankertrojan

© 2018-2024

Terms | Privacy