General

  • Target

    file.exe

  • Size

    213KB

  • Sample

    221218-qxyjdsfa3s

  • MD5

    fa105587a3c9b4b6aa6903c8aed4ecb2

  • SHA1

    55fa7c7bf2a578dfd7c8f1fc14596f0679a2b419

  • SHA256

    bc483dee84c8edf2c844df3b4aea81dbcb5436df698f077ab6624e617b5ad40a

  • SHA512

    867cf9a1cba4daf670a1d91811cf7997f0d738a070a327e0f22a2cb95c7bc8c40685cdaeb0df0ad4ebeed0f0883276d187eef9ed8aed6ce71bf57fd49bc77caf

  • SSDEEP

    3072:juzitXLmXkR8f2+SzuIvHgr3gl+vH8ayDtg3udJSJ0HOil3lk025PH:y0LaHfCzXHSQl+vcQ+do0jlVklPH

Malware Config

Extracted

Family

danabot

C2

23.236.181.126:443

123.253.35.251:443

66.85.173.3:443

Attributes
  • embedded_hash

    8F56CD73F6B5CD5D7B17B0BA61E70A82

  • type

    loader

Targets

    • Target

      file.exe

    • Size

      213KB

    • MD5

      fa105587a3c9b4b6aa6903c8aed4ecb2

    • SHA1

      55fa7c7bf2a578dfd7c8f1fc14596f0679a2b419

    • SHA256

      bc483dee84c8edf2c844df3b4aea81dbcb5436df698f077ab6624e617b5ad40a

    • SHA512

      867cf9a1cba4daf670a1d91811cf7997f0d738a070a327e0f22a2cb95c7bc8c40685cdaeb0df0ad4ebeed0f0883276d187eef9ed8aed6ce71bf57fd49bc77caf

    • SSDEEP

      3072:juzitXLmXkR8f2+SzuIvHgr3gl+vH8ayDtg3udJSJ0HOil3lk025PH:y0LaHfCzXHSQl+vcQ+do0jlVklPH

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

    • Detects Smokeloader packer

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks