General

  • Target

    60963ff08218132f7f570a0a82a8b543b8c659736702139248652e6cbd1cf780

  • Size

    214KB

  • Sample

    221218-q5re2scb94

  • MD5

    5241b5f99e62909635f32e8172591922

  • SHA1

    dbf774a2d1558a368112a7ce2de267060ae2bb92

  • SHA256

    60963ff08218132f7f570a0a82a8b543b8c659736702139248652e6cbd1cf780

  • SHA512

    5bf8deed9200a3bef62734099d41ae42ef87a5b6d7b8c4bd2bcf84a1eb9ed7ad0c5287fc37fab2ec657ab68fede659f91cd3462a47c8ef9c4732e0f6f4b7373e

  • SSDEEP

    3072:ybqSRqaL1Q7RH2luHi6y2cY8XWY/mem+MjPpg3uO7kXHOEHOil3lk025PH:QqWpLyQEVSWummMDK+OYuEjlVklPH

Malware Config

Extracted

Family

danabot

C2

23.236.181.126:443

123.253.35.251:443

66.85.173.3:443

Attributes
  • embedded_hash

    8F56CD73F6B5CD5D7B17B0BA61E70A82

  • type

    loader

Targets

    • Target

      60963ff08218132f7f570a0a82a8b543b8c659736702139248652e6cbd1cf780

    • Size

      214KB

    • MD5

      5241b5f99e62909635f32e8172591922

    • SHA1

      dbf774a2d1558a368112a7ce2de267060ae2bb92

    • SHA256

      60963ff08218132f7f570a0a82a8b543b8c659736702139248652e6cbd1cf780

    • SHA512

      5bf8deed9200a3bef62734099d41ae42ef87a5b6d7b8c4bd2bcf84a1eb9ed7ad0c5287fc37fab2ec657ab68fede659f91cd3462a47c8ef9c4732e0f6f4b7373e

    • SSDEEP

      3072:ybqSRqaL1Q7RH2luHi6y2cY8XWY/mem+MjPpg3uO7kXHOEHOil3lk025PH:QqWpLyQEVSWummMDK+OYuEjlVklPH

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

    • Detects Smokeloader packer

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks