danabot

General

Target

file.exe
Size

307KB
Sample

221219-kz15eaef57
MD5

1ac28017236cafb30ae46b8cfcdd3aff
SHA1

aa0ecc6413d85ed7211628f45f741cfa1f338af5
SHA256

c31c03e3c2e9ec95d2e80453222278603735971083824ce59ae7e8f2850dc6eb
SHA512

a691763218b3b385272398e53ef301328ca78ea895840aca1d46fd85273701a00110ebb153c3c99253c5c179c4383053d4d7e5a89ec9d4926aca73d0b96962ff
SSDEEP

6144:n+65LwOzcNUnWPx0KD5tMIHPmC7AEXQ8/0iPvzpQ6rFiaI:nF7zcNUnWGKDLMIvnnf/xnzpQ6rF

Score

10^/10

Malware Config

Targets

- Target
  
  file.exe
- Size
  
  307KB
- MD5
  
  1ac28017236cafb30ae46b8cfcdd3aff
- SHA1
  
  aa0ecc6413d85ed7211628f45f741cfa1f338af5
- SHA256
  
  c31c03e3c2e9ec95d2e80453222278603735971083824ce59ae7e8f2850dc6eb
- SHA512
  
  a691763218b3b385272398e53ef301328ca78ea895840aca1d46fd85273701a00110ebb153c3c99253c5c179c4383053d4d7e5a89ec9d4926aca73d0b96962ff
- SSDEEP
  
  6144:n+65LwOzcNUnWPx0KD5tMIHPmC7AEXQ8/0iPvzpQ6rFiaI:nF7zcNUnWGKDLMIvnnf/xnzpQ6rF
Score

10^/10

smokeloader backdoor trojan danabot banker discovery
- Danabot
  Danabot is a modular banking Trojan that has been linked with other malware.
  trojan banker danabot
- Detects Smokeloader packer
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detects Smokeloader packer

SmokeLoader

Blocklisted process makes network request

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2