General

  • Target

    ac3cbbc36a7a5c9f551aca322dc0e19578d12a9bca3346cc5ff298e811f1b0f3

  • Size

    141KB

  • Sample

    221219-efdxwahb8w

  • MD5

    66d66067a5a3be4f20b0588055fccb4c

  • SHA1

    13e9870e7d05436c9b0b33ad63f85a77d370ccf9

  • SHA256

    a36ecc3ce3984d107bcd5c67f275d42b94810ab444473ff61a6569f27a23bd40

  • SHA512

    49d088cda965a1dc468c355a0d3cf14ba04d0e199dc99b7800e4b7421a346a1b703092ffb3985b8fbcb713fde62da593bfb001dd4afd1b26e0e7345943423bcc

  • SSDEEP

    3072:KOVVZSRsia0eRpEOihARfTazAQMCzdwjiqcC4hsTLvoWaT4Gn:KOiRuExhkWOCxwuqcOHw7

Malware Config

Targets

    • Target

      ac3cbbc36a7a5c9f551aca322dc0e19578d12a9bca3346cc5ff298e811f1b0f3

    • Size

      214KB

    • MD5

      dbac1e546c31e01df2df4b2ebee2f2b5

    • SHA1

      f7837f0e02f5c0e7f3dd5ad86ee9946e1a6c81d1

    • SHA256

      ac3cbbc36a7a5c9f551aca322dc0e19578d12a9bca3346cc5ff298e811f1b0f3

    • SHA512

      59772e87a7b596dda7afb9895fa00c5eaaacc423c8260f6c9bbca1b5218cc48424e12fb6c2d810252fbad8a8217b9d642c99dcb1d43c15d3a5228cd3cf9054e7

    • SSDEEP

      3072:WwUBO36L+Zj21WClRB4cRO0BZyGiyctNRAtOba+3QnBtjcbImdzmuX:nUBNL+x21j9xRO0BZ/ct03BtjcbXF

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

    • Detects Smokeloader packer

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks