Overview

overview

10

Static

static

216d1e4e78...52.exe

windows7-x64

10

216d1e4e78...52.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    216d1e4e78931e29ee5230f138e65449185fdd1979713a337eaac8591b7fd152

  • Size

    141KB

  • Sample

    221219-yejaraba5x

  • MD5

    42934d6569b0675b681a140e0760bd1b

  • SHA1

    c4f2917d0303419c0797c6e3c35beadbf61bcc9a

  • SHA256

    a272aca31891059e997a76a67216a1e9bd96e0e2b02ae41e0aaac6c557c036b1

  • SHA512

    702582b1dabad8bb70baedd957d6c57ca2a82fb4fe977dc3ad6f16e7f427151836147989a10e6b2229b3763c19f1987daef4ef53a5120bc415132b96a65e1d5a

  • SSDEEP

    3072:3540ILoYJiBoZU3VkFv1RiRxsm6qxXkk3rwSmuTT:vIcgiyOVkFvzYxfdxt3r1T

Score
10/10
danabotsmokeloaderbackdoorbankertrojan

Malware Config

Targets

    • Target

      216d1e4e78931e29ee5230f138e65449185fdd1979713a337eaac8591b7fd152

    • Size

      214KB

    • MD5

      add9e0006f8120c1bf13bee5181a74b7

    • SHA1

      27c31ee11cd85cca5c77a9666c520a224b821a85

    • SHA256

      216d1e4e78931e29ee5230f138e65449185fdd1979713a337eaac8591b7fd152

    • SHA512

      d1f19281705658272372873b86651ae3f977565362f34d2c7645c22efa0f37910cc4f6dacbc5358b00ee0991cd9178477b52ff09730a61286a2f029186597d1b

    • SSDEEP

      3072:z/gA6sLirHaRVoXuV9weWQI0NvOKfFXO9OlfgnHaNRAtOba+JHt5fjcbImdzmuX:zTNLirmtV9we9ICIIM6023fjcbXF

    Score
    10/10
    smokeloaderbackdoortrojandanabotbanker

    • Danabot

      Danabot is a modular banking Trojan that has been linked with other malware.

      trojanbankerdanabot

    • Detects Smokeloader packer

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks