Overview

overview

10

Static

static

36962dbe21...07.exe

windows7-x64

10

36962dbe21...07.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    36962dbe21b03b6b13e7a6e607f908eb54c0fa8d511d3d522fcb31322c938007

  • Size

    204KB

  • Sample

    221219-vtpjjaaf3w

  • MD5

    7239fb8f6a2f46bdea781e3cf59cd555

  • SHA1

    ab976c51db812da0c920c7ad31ffc0e7883a438e

  • SHA256

    ff78e290b8109c870dce38e489788eeac2370f3a2cb14349f3ff3fd90b9428c8

  • SHA512

    e8c424645be21f726affeaefc5b4ad0c2930210be3a7b44b3d786effb51563d0e549a6b9758ddcc0e9d660b9ee5b3470c3c650985e0de7fa1b9cb3923ad120cf

  • SSDEEP

    6144:j6z2COoEoMDPc7K+/eWOGkLcobPHaxzLnMSwBOf6Kc:ez2RvRDPGKXbBoobP6FMSwBO+

Score
10/10
danabotsmokeloaderbackdoorbankertrojan

Malware Config

Targets

    • Target

      36962dbe21b03b6b13e7a6e607f908eb54c0fa8d511d3d522fcb31322c938007

    • Size

      310KB

    • MD5

      c6d5caf032d4435e71637bd333f174fb

    • SHA1

      1971852a4bedd32ac3a74d7a9600dcb369e71cce

    • SHA256

      36962dbe21b03b6b13e7a6e607f908eb54c0fa8d511d3d522fcb31322c938007

    • SHA512

      7a7176c80ade6000dbb7a4b94cb11f229b360ea8adab69d829cf24541d5f364e9f6143a697f1c839336da98261f9a038aacc4c463b90d67bb2fba56158d8144e

    • SSDEEP

      6144:+gxRLtYltAaD+/eWOGkLc3zJJaRH4rWlRjO1n:+qRpYlt5DXbBotJayrW9u

    Score
    10/10
    smokeloaderbackdoortrojandanabotbanker

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

      trojanbankerdanabot

    • Detects Smokeloader packer

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks