Overview

overview

10

Static

static

ac3cbbc36a...f3.exe

windows7-x64

10

ac3cbbc36a...f3.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ac3cbbc36a7a5c9f551aca322dc0e19578d12a9bca3346cc5ff298e811f1b0f3

  • Size

    141KB

  • Sample

    221219-d7n2gshb5x

  • MD5

    9a864445b76676e2fecc3bb49b4a02ef

  • SHA1

    7e42a713577d3fab93f8f164ab63ac6f16193bcc

  • SHA256

    a5f96164bd7f993d8179f1d7a845edd587330256c08eee09010a877dbd2611e6

  • SHA512

    7b08f40740325bad425a433c8008e718d24733be639273b9a50c4ec786eb5ba5c3d520d61508408982079a08177d3e085c4d814e2be40e07a9bda060db40c310

  • SSDEEP

    3072:sOVVZSRsia0eRpEOihARfTazAQMCzdwjiqcC4hsTLvoWaT4GB:sOiRuExhkWOCxwuqcOHw9

Score
10/10
danabotsmokeloaderbackdoorbankertrojan

Malware Config

Targets

    • Target

      ac3cbbc36a7a5c9f551aca322dc0e19578d12a9bca3346cc5ff298e811f1b0f3

    • Size

      214KB

    • MD5

      dbac1e546c31e01df2df4b2ebee2f2b5

    • SHA1

      f7837f0e02f5c0e7f3dd5ad86ee9946e1a6c81d1

    • SHA256

      ac3cbbc36a7a5c9f551aca322dc0e19578d12a9bca3346cc5ff298e811f1b0f3

    • SHA512

      59772e87a7b596dda7afb9895fa00c5eaaacc423c8260f6c9bbca1b5218cc48424e12fb6c2d810252fbad8a8217b9d642c99dcb1d43c15d3a5228cd3cf9054e7

    • SSDEEP

      3072:WwUBO36L+Zj21WClRB4cRO0BZyGiyctNRAtOba+3QnBtjcbImdzmuX:nUBNL+x21j9xRO0BZ/ct03BtjcbXF

    Score
    10/10
    smokeloaderbackdoortrojandanabotbanker

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

      trojanbankerdanabot

    • Detects Smokeloader packer

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks