danabot

General

Target

file.exe
Size

255KB
Sample

231118-n4kvrseh4x
MD5

1e19ec3c79ed9c25ae6127b88dbef6a8
SHA1

4c563a4dee161e349c13ac2a52b972d417be9d8f
SHA256

407c8e4e1a4fcba52d051e64eb52e67ad3ed5b1e1b41d41f21f7f6d32fd549f0
SHA512

b28e199bacaed17b26afa31eead833ee5327e6077b48cb4adc94bc8dfe074e0b2a462f314375049a3ed2db98d38f92be4d385321e17be3e5d3f2622269de58d6
SSDEEP

3072:x9xG5ACUDCyyIfW313kWGVRR1R5eFyI/jTRS926mMBG/p/4CY7:pHCVTkW310WOvek926YG

Score

10^/10

danabot redline smokeloader 13 pub4 backdoor banker discovery infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub4

Extracted

Family

smokeloader

Version

2022

C2

http://dpav.cc/tmp/

http://lrproduct.ru/tmp/

http://kggcp.com/tmp/

http://talesofpirates.net/tmp/

http://pirateking.online/tmp/

http://piratia.pw/tmp/

http://go-piratia.ru/tmp/

rc4.i32

Extracted

Family

redline

Botnet

13

C2

77.91.68.235:9486

Targets

- Target
  
  file.exe
- Size
  
  255KB
- MD5
  
  1e19ec3c79ed9c25ae6127b88dbef6a8
- SHA1
  
  4c563a4dee161e349c13ac2a52b972d417be9d8f
- SHA256
  
  407c8e4e1a4fcba52d051e64eb52e67ad3ed5b1e1b41d41f21f7f6d32fd549f0
- SHA512
  
  b28e199bacaed17b26afa31eead833ee5327e6077b48cb4adc94bc8dfe074e0b2a462f314375049a3ed2db98d38f92be4d385321e17be3e5d3f2622269de58d6
- SSDEEP
  
  3072:x9xG5ACUDCyyIfW313kWGVRR1R5eFyI/jTRS926mMBG/p/4CY7:pHCVTkW310WOvek926YG
Score

10^/10

danabot redline smokeloader 13 pub4 backdoor banker discovery infostealer persistence spyware stealer trojan
- Danabot
  Danabot is a modular banking Trojan that has been linked with other malware.
  trojan banker danabot
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Downloads MZ/PE file
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2