danabot | 20b5fb49c28e86e3fe71b9d15b37dae3a41f49b19a5a5e556a87d375232b15e6 | Triage

Submit
Reports

Overview

overview

Static

static

dridex

windows10-2004-x64

Sharing

General

Target

20b5fb49c28e86e3fe71b9d15b37dae3a41f49b19a5a5e556a87d375232b15e6
Size

215KB
Sample

221220-t1er8sac89
MD5

112e838468228d577926f084a7950a04
SHA1

f502734b1274fd8f2044d09f1312ab5641901552
SHA256

20b5fb49c28e86e3fe71b9d15b37dae3a41f49b19a5a5e556a87d375232b15e6
SHA512

30e7b865322ef9c62f05b63cfd68e29ec402acb6e49c731fbadad4055c6de1760418430870c9cc47cd8377cd90f0028ccea430f3481a93954fdfcdd7489b762b
SSDEEP

3072:acqRLCjezN5Q6pZB74PvuG7b/pnUk5NHCDml:pmLCjEB0jxUGCa

Score

10^/10

danabot smokeloader backdoor banker trojan

Static task

static1

Behavioral task

behavioral1

Sample

20b5fb49c28e86e3fe71b9d15b37dae3a41f49b19a5a5e556a87d375232b15e6.exe

Resource

win10v2004-20220812-en

danabot smokeloader backdoor banker trojan

windows10-2004-x64

22 signatures

150 seconds

Malware Config

Targets

- Target
  
  20b5fb49c28e86e3fe71b9d15b37dae3a41f49b19a5a5e556a87d375232b15e6
- Size
  
  215KB
- MD5
  
  112e838468228d577926f084a7950a04
- SHA1
  
  f502734b1274fd8f2044d09f1312ab5641901552
- SHA256
  
  20b5fb49c28e86e3fe71b9d15b37dae3a41f49b19a5a5e556a87d375232b15e6
- SHA512
  
  30e7b865322ef9c62f05b63cfd68e29ec402acb6e49c731fbadad4055c6de1760418430870c9cc47cd8377cd90f0028ccea430f3481a93954fdfcdd7489b762b
- SSDEEP
  
  3072:acqRLCjezN5Q6pZB74PvuG7b/pnUk5NHCDml:pmLCjEB0jxUGCa
Score

10^/10

danabot smokeloader backdoor banker trojan
- Danabot
  Danabot is a modular banking Trojan that has been linked with other malware.
  trojan banker danabot
- Detects Smokeloader packer
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

danabotsmokeloaderbackdoorbankertrojan

© 2018-2024

Terms | Privacy