danabot

General

Target
file.exe
Size 215KB
Sample221013-cf43ysafd4
SHA256 22ec022d1eeb110a71d1bf85083eae8006666d116793734eef47548a3e12ffb7
MD5 791837dbb137512ca20fd440a11725ed
SHA1 b2cbc25c3c977f13e568006bb90b3e7d4acd45b8
SHA512 b6cddf1ac1a11fcbd3518f7b95b29f12f7624254b98c925708427b3c6ef9c95eb1a361718061e57e76d582045c8e4634bda4bb5b9b32c610a10032bca5630539
SSDEEP 3072:wUXGjk+taGLDReALlDWheO1u/5Xa+k9oG8H1YCukHmsrQ1oK+O:wS+kbcZLlDWhY5K5e1YCut6Qf+
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

danabot

Attributes

embedded_hash
56951C922035D696BFCE443750496462
type
loader

Targets

- Target
  file.exe
- Size 215KB
- SHA256 22ec022d1eeb110a71d1bf85083eae8006666d116793734eef47548a3e12ffb7
- MD5 791837dbb137512ca20fd440a11725ed
- SHA1 b2cbc25c3c977f13e568006bb90b3e7d4acd45b8
- SHA512 b6cddf1ac1a11fcbd3518f7b95b29f12f7624254b98c925708427b3c6ef9c95eb1a361718061e57e76d582045c8e4634bda4bb5b9b32c610a10032bca5630539
- SSDEEP 3072:wUXGjk+taGLDReALlDWheO1u/5Xa+k9oG8H1YCukHmsrQ1oK+O:wS+kbcZLlDWhY5K5e1YCut6Qf+
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

smokeloader backdoor trojan danabot banker
- Danabot
  Danabot is a modular banking Trojan that has been linked with other malware.
  trojan banker danabot
- Detects Smokeloader packer
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Downloads MZ/PE file
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detects Smokeloader packer

SmokeLoader

Downloads MZ/PE file

Executes dropped EXE

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2