Overview

overview

10

Static

static

ac3cbbc36a...f3.exe

windows7-x64

10

ac3cbbc36a...f3.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ac3cbbc36a7a5c9f551aca322dc0e19578d12a9bca3346cc5ff298e811f1b0f3

  • Size

    141KB

  • Sample

    221219-gj7epshc9y

  • MD5

    4a8fd87b52492938250c2290ae3436d9

  • SHA1

    efb96e1d6a3717d4aff03ab0b8596bc829281e2d

  • SHA256

    7270a36b116b5fa0f563a6909cd02f9380d6be7a6f8f31d85d9cee35d78f48d8

  • SHA512

    d516d40430bd622577900656ad8598b14d3110723880c3cd0f62d003f2f9785157d6a94516f7a1ac5913418f0516c0084378bec062b2eb6fd8240c3fff479e30

  • SSDEEP

    3072:ROVVZSRsia0eRpEOihARfTazAQMCzdwjiqcC4hsTLvoWaT4Gq:ROiRuExhkWOCxwuqcOHwG

Score
10/10
danabotsmokeloaderbackdoorbankerpersistencetrojan

Malware Config

Targets

    • Target

      ac3cbbc36a7a5c9f551aca322dc0e19578d12a9bca3346cc5ff298e811f1b0f3

    • Size

      214KB

    • MD5

      dbac1e546c31e01df2df4b2ebee2f2b5

    • SHA1

      f7837f0e02f5c0e7f3dd5ad86ee9946e1a6c81d1

    • SHA256

      ac3cbbc36a7a5c9f551aca322dc0e19578d12a9bca3346cc5ff298e811f1b0f3

    • SHA512

      59772e87a7b596dda7afb9895fa00c5eaaacc423c8260f6c9bbca1b5218cc48424e12fb6c2d810252fbad8a8217b9d642c99dcb1d43c15d3a5228cd3cf9054e7

    • SSDEEP

      3072:WwUBO36L+Zj21WClRB4cRO0BZyGiyctNRAtOba+3QnBtjcbImdzmuX:nUBNL+x21j9xRO0BZ/ct03BtjcbXF

    Score
    10/10
    smokeloaderbackdoortrojandanabotbankerpersistence

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

      trojanbankerdanabot

    • Detects Smokeloader packer

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Sets DLL path for service in the registry

      persistence

    • Sets service image path in registry

      persistence

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks