danabot

General

Target

77fc32d4fcce645af017a158d936157812dff7acdf3058aeab34be951ac84af4.exe
Size

215KB
Sample

221219-1dmmwsgb63
MD5

08fa9f1d8984a00ec5a564ce52d06270
SHA1

dac36d9e45a67b34031cd5a8bd0a6dd15f092f8e
SHA256

77fc32d4fcce645af017a158d936157812dff7acdf3058aeab34be951ac84af4
SHA512

a554bbae4276248478b56f5d4109a9123407962bb3dd057dcaa7ad752e5c053e12f985017c4f247c9d226037430dfcc3d961068d35e215cc39b28f4901b5e5cf
SSDEEP

3072:s2ESpLpExX43R5ubvqLsb+2QGqRI8cHNRAtOba+GfQ4pgSjcbImdzmuX:bEGLpWX5q3j00JDpgSjcbXF

Score

10^/10

Malware Config

Targets

- Target
  
  77fc32d4fcce645af017a158d936157812dff7acdf3058aeab34be951ac84af4.exe
- Size
  
  215KB
- MD5
  
  08fa9f1d8984a00ec5a564ce52d06270
- SHA1
  
  dac36d9e45a67b34031cd5a8bd0a6dd15f092f8e
- SHA256
  
  77fc32d4fcce645af017a158d936157812dff7acdf3058aeab34be951ac84af4
- SHA512
  
  a554bbae4276248478b56f5d4109a9123407962bb3dd057dcaa7ad752e5c053e12f985017c4f247c9d226037430dfcc3d961068d35e215cc39b28f4901b5e5cf
- SSDEEP
  
  3072:s2ESpLpExX43R5ubvqLsb+2QGqRI8cHNRAtOba+GfQ4pgSjcbImdzmuX:bEGLpWX5q3j00JDpgSjcbXF
Score

10^/10

smokeloader backdoor trojan danabot banker discovery
- Danabot
  Danabot is a modular banking Trojan that has been linked with other malware.
  trojan banker danabot
- Detects Smokeloader packer
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detects Smokeloader packer

SmokeLoader

Blocklisted process makes network request

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2