danabot

General

Target

d75b501a09398280bf6e9250ac56763182136b4980d86e43c93d0ad8fa9981ac
Size

206KB
Sample

221219-ttajyaae5v
MD5

49d15f9b72de39c53ef6f5d78b6ba628
SHA1

7fc3e0d92e69d182432bb3d1bfa25a9e1e7a7a6f
SHA256

00eed1dbe117afbdda172c05d74dfaeb3d3f86eca70d12a58408b929b32286b4
SHA512

5640b01cf482e98dc32a005ee43d1344cf7922e25b1a694f5c6a8d84b04b5f6878ce3d24eebc8aa1c200c97891743c6959efed9b623c5f650da48d9b74e05c55
SSDEEP

3072:w1eK2F/szRcjUOp01Ph5FvI99rZ0N66SraY6GxvVT7BZgsoxADLMXaXK:wsh0Rjbjq9rZ0NCHvVTUvxMK

Score

10^/10

Malware Config

Targets

- Target
  
  d75b501a09398280bf6e9250ac56763182136b4980d86e43c93d0ad8fa9981ac
- Size
  
  311KB
- MD5
  
  ff8b0ef6c574e5f6f1fa4c4eb75c637d
- SHA1
  
  3263f6595d1329cea9348b34a9857a98998a33c6
- SHA256
  
  d75b501a09398280bf6e9250ac56763182136b4980d86e43c93d0ad8fa9981ac
- SHA512
  
  9c2d049aaf278d86db69256dd312cf34d1d1b6dcabe964b93ab2a29b21f9045bceaaf809b46c92e6c4f5d5f27befda9692712fc23c4d45de2bef147c98708ff4
- SSDEEP
  
  6144:zjB1L2OqdTTq9rZ0NCKg4bBYqH4rWlRjO1n:zPHqdTuduLlarW9u
Score

10^/10

smokeloader backdoor trojan danabot banker discovery
- Danabot
  Danabot is a modular banking Trojan that has been linked with other malware.
  trojan banker danabot
- Detects Smokeloader packer
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detects Smokeloader packer

SmokeLoader

Blocklisted process makes network request

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2