danabot | 216d1e4e78931e29ee5230f138e65449185fdd1979713a337eaac8591b7fd152 | Triage

Submit
Reports

Overview

overview

Static

static

dridex

windows10-2004-x64

Sharing

General

Target

216d1e4e78931e29ee5230f138e65449185fdd1979713a337eaac8591b7fd152
Size

214KB
Sample

221219-eemtdshb8v
MD5

add9e0006f8120c1bf13bee5181a74b7
SHA1

27c31ee11cd85cca5c77a9666c520a224b821a85
SHA256

216d1e4e78931e29ee5230f138e65449185fdd1979713a337eaac8591b7fd152
SHA512

d1f19281705658272372873b86651ae3f977565362f34d2c7645c22efa0f37910cc4f6dacbc5358b00ee0991cd9178477b52ff09730a61286a2f029186597d1b
SSDEEP

3072:z/gA6sLirHaRVoXuV9weWQI0NvOKfFXO9OlfgnHaNRAtOba+JHt5fjcbImdzmuX:zTNLirmtV9we9ICIIM6023fjcbXF

Score

10^/10

danabot smokeloader backdoor banker discovery trojan

Static task

static1

Behavioral task

behavioral1

Sample

216d1e4e78931e29ee5230f138e65449185fdd1979713a337eaac8591b7fd152.exe

Resource

win10v2004-20221111-en

danabot smokeloader backdoor banker discovery trojan

windows10-2004-x64

24 signatures

150 seconds

Malware Config

Targets

- Target
  
  216d1e4e78931e29ee5230f138e65449185fdd1979713a337eaac8591b7fd152
- Size
  
  214KB
- MD5
  
  add9e0006f8120c1bf13bee5181a74b7
- SHA1
  
  27c31ee11cd85cca5c77a9666c520a224b821a85
- SHA256
  
  216d1e4e78931e29ee5230f138e65449185fdd1979713a337eaac8591b7fd152
- SHA512
  
  d1f19281705658272372873b86651ae3f977565362f34d2c7645c22efa0f37910cc4f6dacbc5358b00ee0991cd9178477b52ff09730a61286a2f029186597d1b
- SSDEEP
  
  3072:z/gA6sLirHaRVoXuV9weWQI0NvOKfFXO9OlfgnHaNRAtOba+JHt5fjcbImdzmuX:zTNLirmtV9we9ICIIM6023fjcbXF
Score

10^/10

danabot smokeloader backdoor banker discovery trojan
- Danabot
  Danabot is a modular banking Trojan that has been linked with other malware.
  trojan banker danabot
- Detects Smokeloader packer
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

danabotsmokeloaderbackdoorbankerdiscoverytrojan

© 2018-2024

Terms | Privacy