danabot

General

Target

file.exe
Size

214KB
Sample

221218-q88thacc29
MD5

30d9d1c7e72b46e65041398f611cf11c
SHA1

f67c7b6f2d885df78ba6f592946c36be6ed4e9da
SHA256

cbbf11437454890e0fd1aa7dc52f673278167086be223d98a150ee442e46e990
SHA512

3c11f8772aed1a7c68dec663d41ee899fe816a1ed37d31f1e3af245328141bee0f077575712c2dcd350ef435c62defea0e4caf78e3f9e5f363f0f79fe41f2298
SSDEEP

3072:KBwHoLP21Rv0lS7NtXfOaEGUJjTeN5g3um/obHtHOil3lk025PH:G7LuL0aXfJmFTn+m/AtjlVklPH

Score

10^/10

Malware Config

Extracted

Family

danabot

C2

23.236.181.126:443

123.253.35.251:443

66.85.173.3:443

Attributes

embedded_hash
8F56CD73F6B5CD5D7B17B0BA61E70A82
type
loader

Targets

- Target
  
  file.exe
- Size
  
  214KB
- MD5
  
  30d9d1c7e72b46e65041398f611cf11c
- SHA1
  
  f67c7b6f2d885df78ba6f592946c36be6ed4e9da
- SHA256
  
  cbbf11437454890e0fd1aa7dc52f673278167086be223d98a150ee442e46e990
- SHA512
  
  3c11f8772aed1a7c68dec663d41ee899fe816a1ed37d31f1e3af245328141bee0f077575712c2dcd350ef435c62defea0e4caf78e3f9e5f363f0f79fe41f2298
- SSDEEP
  
  3072:KBwHoLP21Rv0lS7NtXfOaEGUJjTeN5g3um/obHtHOil3lk025PH:G7LuL0aXfJmFTn+m/AtjlVklPH
Score

10^/10

smokeloader backdoor trojan danabot banker discovery
- Danabot
  Danabot is a modular banking Trojan that has been linked with other malware.
  trojan banker danabot
- Detects Smokeloader packer
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detects Smokeloader packer

SmokeLoader

Blocklisted process makes network request

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2