danabot

General

Target

file.exe
Size

221KB
Sample

221221-gva6msbg49
MD5

b4cc7f9e1425c25f8a7c1a6b007cdb8a
SHA1

ca8f66154f1c73766c3490c1bfa00eba01c78f35
SHA256

93809ca37ec6d91dba9e24f470bc7f371d325a0d152ce5510c61de8e5e6af52c
SHA512

748ed7b7d5d8e03d75c0f776f6b6ee1b0a5d89d527f4e9f065c51ece781a55ab531e48f25168ab7e0ef8a312493746cf59a51668616a866ad2ca8c05ad427a4e
SSDEEP

3072:1DrFLZyBt15r7TVKFcyjWeAxHeWElsi7b/JONFXNHCDml:NZLZyBhTVYcwKeW0edCa

Score

10^/10

Malware Config

Targets

- Target
  
  file.exe
- Size
  
  221KB
- MD5
  
  b4cc7f9e1425c25f8a7c1a6b007cdb8a
- SHA1
  
  ca8f66154f1c73766c3490c1bfa00eba01c78f35
- SHA256
  
  93809ca37ec6d91dba9e24f470bc7f371d325a0d152ce5510c61de8e5e6af52c
- SHA512
  
  748ed7b7d5d8e03d75c0f776f6b6ee1b0a5d89d527f4e9f065c51ece781a55ab531e48f25168ab7e0ef8a312493746cf59a51668616a866ad2ca8c05ad427a4e
- SSDEEP
  
  3072:1DrFLZyBt15r7TVKFcyjWeAxHeWElsi7b/JONFXNHCDml:NZLZyBhTVYcwKeW0edCa
Score

10^/10

smokeloader backdoor trojan danabot banker discovery
- Danabot
  Danabot is a modular banking Trojan that has been linked with other malware.
  trojan banker danabot
- Detects Smokeloader packer
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detects Smokeloader packer

SmokeLoader

Blocklisted process makes network request

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2