danabot

General

Target

a326ea034a7c1e3e5c9db7c0bf8481d18cecfdcaf1e8e8155c0b6ceb1dd574c0
Size

202KB
Sample

221219-wyrp5aag3z
MD5

e2c806614b22ef4ead24a4e308bcb2c0
SHA1

5d26552883abf8a5a9f0e5ed7d37850e942788a2
SHA256

f8b196c668706f608a7d4acc0a0a57f6397a1691e564fa1b49208d28fe089187
SHA512

33a8911e517f375861dc18a67659e52041df6db28b5a2fbff5c745c39faffa858f1abed8e3d924f0b0dbd03cf36fd65a3f0a32a2729693fc696206e736b708ac
SSDEEP

6144:Wthlz0O4E4WCmseICh2oUV7KDoaqsin4Wj+5:Ul4y7u+2Pyqsi4Wy5

Score

10^/10

Malware Config

Targets

- Target
  
  a326ea034a7c1e3e5c9db7c0bf8481d18cecfdcaf1e8e8155c0b6ceb1dd574c0
- Size
  
  305KB
- MD5
  
  38534d532efd591c8e8ac97eca8d0571
- SHA1
  
  732865d75c66eb16492b3efc24dd650079744b60
- SHA256
  
  a326ea034a7c1e3e5c9db7c0bf8481d18cecfdcaf1e8e8155c0b6ceb1dd574c0
- SHA512
  
  6d2a384dfe6efa8dea22370f1564a3589536fdf90a9de6ea99828d3137af064de51a9ee8113becc3327203e2f5f265a8bcf27a7f9171bcb3c68e98db84293c6a
- SSDEEP
  
  6144:Zv8ILSYLFj8iAkseICh2oC0XDxO0iPvzpQ6rFiaI:Z/fLFgku+2oVxOxnzpQ6rF
Score

10^/10

smokeloader backdoor trojan danabot banker discovery
- Danabot
  Danabot is a modular banking Trojan that has been linked with other malware.
  trojan banker danabot
- Detects Smokeloader packer
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detects Smokeloader packer

SmokeLoader

Blocklisted process makes network request

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2