danabot | ab1d6afb8ddb1f5bdea0f508ded3ed73a1c239350ec909ff03c66eb6e8b568e8 | Triage

Submit
Reports

Overview

overview

Static

static

216d1e4e78...52.exe

windows7-x64

216d1e4e78...52.exe

windows10-2004-x64

Sharing

General

Target

216d1e4e78931e29ee5230f138e65449185fdd1979713a337eaac8591b7fd152
Size

141KB
Sample

221219-yh2lhaba7t
MD5

c82fe0b7fb379e14159790717e4a8020
SHA1

8b6e350f17d413bab4a4ffda5d430af18e3d5e0a
SHA256

ab1d6afb8ddb1f5bdea0f508ded3ed73a1c239350ec909ff03c66eb6e8b568e8
SHA512

e6c85e2ab303aae5dcf01881930204b12417573013838539e695e703d8b553eaa90c2a9dc4b4dd377a7ca9c282c3afd50915ebaeef6e710ab1639d884e96ca94
SSDEEP

3072:E540ILoYJiBoZU3VkFv1RiRxsm6qxXkk3rwSmuTA:qIcgiyOVkFvzYxfdxt3r1A

Score

10^/10

danabot smokeloader backdoor banker discovery trojan

Static task

static1

Behavioral task

behavioral1

Sample

216d1e4e78931e29ee5230f138e65449185fdd1979713a337eaac8591b7fd152.exe

Resource

win7-20221111-en

smokeloader backdoor trojan

windows7-x64

6 signatures

150 seconds

Behavioral task

behavioral2

Sample

216d1e4e78931e29ee5230f138e65449185fdd1979713a337eaac8591b7fd152.exe

Resource

win10v2004-20221111-en

danabot smokeloader backdoor banker discovery trojan

windows10-2004-x64

20 signatures

150 seconds

Malware Config

Targets

- Target
  
  216d1e4e78931e29ee5230f138e65449185fdd1979713a337eaac8591b7fd152
- Size
  
  214KB
- MD5
  
  add9e0006f8120c1bf13bee5181a74b7
- SHA1
  
  27c31ee11cd85cca5c77a9666c520a224b821a85
- SHA256
  
  216d1e4e78931e29ee5230f138e65449185fdd1979713a337eaac8591b7fd152
- SHA512
  
  d1f19281705658272372873b86651ae3f977565362f34d2c7645c22efa0f37910cc4f6dacbc5358b00ee0991cd9178477b52ff09730a61286a2f029186597d1b
- SSDEEP
  
  3072:z/gA6sLirHaRVoXuV9weWQI0NvOKfFXO9OlfgnHaNRAtOba+JHt5fjcbImdzmuX:zTNLirmtV9we9ICIIM6023fjcbXF
Score

10^/10

smokeloader backdoor trojan danabot banker discovery
- Danabot
  Danabot is a modular banking Trojan that has been linked with other malware.
  trojan banker danabot
- Detects Smokeloader packer
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

smokeloaderbackdoortrojan

behavioral2

danabotsmokeloaderbackdoorbankerdiscoverytrojan

© 2018-2024

Terms | Privacy