Overview

overview

10

Static

static

1550510aa2...f3.exe

windows7-x64

10

1550510aa2...f3.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1550510aa27041e5d414070d4b10af13d3ca1e44f86c351e8498e52b0939f2f3

  • Size

    142KB

  • Sample

    221219-enkemaeb87

  • MD5

    f3067deca7229a078188bb893bee451e

  • SHA1

    fe7325aa98d87bfc5510c359ce0feac0ccf004de

  • SHA256

    fe7112e8d337934bbd8b0fd548d5d0933b26870b815222874566baf2f969c59b

  • SHA512

    fdea6ebc3d30897b3e2f7abe66baf952106cd7550942ca28cb333e40c1045e26c30ee286cf9324446fcfa1eb059fa570d207ad2826b7176b34809c3c5cf08755

  • SSDEEP

    3072:RFkCWNga7wIcYjCbeJCbKMOY3vUHfG5chAPJuwJ+p6rA:HWiBYObwCbKM93s/mcWBpVk

Score
10/10
danabotsmokeloaderbackdoorbankertrojan

Malware Config

Targets

    • Target

      1550510aa27041e5d414070d4b10af13d3ca1e44f86c351e8498e52b0939f2f3

    • Size

      214KB

    • MD5

      3a169176f43bac6c9c629071b6ac513b

    • SHA1

      782aa22755e4c862c3eab8a3aa70ae4c08170922

    • SHA256

      1550510aa27041e5d414070d4b10af13d3ca1e44f86c351e8498e52b0939f2f3

    • SHA512

      df820fb5296753b05c8edf74db8ff227801494e03b9b7c1e0d1c6d5f7b5012a4421820c6db215a85dc56b7bd03ff9b84a488651d47070397eb3055cece178d24

    • SSDEEP

      3072:FQOs2LR24RRhMbpyUifPwVSRch12Q6h+ThDg3uwlbZHPvHOil3lk025PH:C+LoTbti3wVG08iVU+41vvjlVklPH

    Score
    10/10
    smokeloaderbackdoortrojandanabotbanker

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

      trojanbankerdanabot

    • Detects Smokeloader packer

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks