danabot | f247b1719c9f12c3c43b53de840ea3fc6574568f6d1cf779fa45d516fa1fd710 | Triage

Submit
Reports

Overview

overview

Static

static

dridex

windows10-2004-x64

Sharing

General

Target

f247b1719c9f12c3c43b53de840ea3fc6574568f6d1cf779fa45d516fa1fd710
Size

304KB
Sample

221219-xjrx1sah2t
MD5

1053d178c3d3dcd5ad9b505c8cd252f4
SHA1

3e31db62de8fb2aeca2f268f9cacf85f73855933
SHA256

f247b1719c9f12c3c43b53de840ea3fc6574568f6d1cf779fa45d516fa1fd710
SHA512

18afcee63fa8079a55a864b9c0a5f61978e1dd4848a0ffbf4b8dc1d521e65487230ada08d0a1eec50d1708a37e37f8edd8ba90d759fdba857395f721e17facd0
SSDEEP

6144:JLRweAJiQhjD2AjHtCGz+3ng+E49HwchLP3i:JeeABDLHwnVZH9P3

Score

10^/10

danabot smokeloader backdoor banker discovery trojan

Static task

static1

Behavioral task

behavioral1

Sample

f247b1719c9f12c3c43b53de840ea3fc6574568f6d1cf779fa45d516fa1fd710.exe

Resource

win10v2004-20220812-en

danabot smokeloader backdoor banker discovery trojan

windows10-2004-x64

24 signatures

150 seconds

Malware Config

Targets

- Target
  
  f247b1719c9f12c3c43b53de840ea3fc6574568f6d1cf779fa45d516fa1fd710
- Size
  
  304KB
- MD5
  
  1053d178c3d3dcd5ad9b505c8cd252f4
- SHA1
  
  3e31db62de8fb2aeca2f268f9cacf85f73855933
- SHA256
  
  f247b1719c9f12c3c43b53de840ea3fc6574568f6d1cf779fa45d516fa1fd710
- SHA512
  
  18afcee63fa8079a55a864b9c0a5f61978e1dd4848a0ffbf4b8dc1d521e65487230ada08d0a1eec50d1708a37e37f8edd8ba90d759fdba857395f721e17facd0
- SSDEEP
  
  6144:JLRweAJiQhjD2AjHtCGz+3ng+E49HwchLP3i:JeeABDLHwnVZH9P3
Score

10^/10

danabot smokeloader backdoor banker discovery trojan
- Danabot
  Danabot is a modular banking Trojan that has been linked with other malware.
  trojan banker danabot
- Detects Smokeloader packer
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

danabotsmokeloaderbackdoorbankerdiscoverytrojan

© 2018-2024

Terms | Privacy