danabot

General

Target
file.exe
Size 224KB
Sample221022-2dmtbsfcdm
SHA256 67f37873b31a614aaff0f134fd474843c6dcf12cf5dd41102d2c691c0b028601
MD5 6609152c1e8e05e0970fd99732eecd65
SHA1 316a138d9ba79729daad5e1f35e84a1c448de8e6
SHA512 47b2852a033b0ca46371bd34d38551c6501ab9f272d92e4a03330bc96adced8eb95680547d38e756d5677e763938cc7d5c6ce1446b6ae3258dd9951b3dec341c
SSDEEP 3072:yXihzLm4sFXu2Z5RZX0OGEpqPVY6nF0uHRqyUDSxIz8An:yEzL8Fe2NZuHnFvxqDWIzp
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

danabot

Attributes

embedded_hash
569235DCA8F16ED8310BBACCB674F896
type
loader

Targets

- Target
  file.exe
- Size 224KB
- SHA256 67f37873b31a614aaff0f134fd474843c6dcf12cf5dd41102d2c691c0b028601
- MD5 6609152c1e8e05e0970fd99732eecd65
- SHA1 316a138d9ba79729daad5e1f35e84a1c448de8e6
- SHA512 47b2852a033b0ca46371bd34d38551c6501ab9f272d92e4a03330bc96adced8eb95680547d38e756d5677e763938cc7d5c6ce1446b6ae3258dd9951b3dec341c
- SSDEEP 3072:yXihzLm4sFXu2Z5RZX0OGEpqPVY6nF0uHRqyUDSxIz8An:yEzL8Fe2NZuHnFvxqDWIzp
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

smokeloader backdoor trojan danabot banker
- Danabot
  Danabot is a modular banking Trojan that has been linked with other malware.
  trojan banker danabot
- Detects Smokeloader packer
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Downloads MZ/PE file
- Executes dropped EXE
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

4

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detects Smokeloader packer

SmokeLoader

Downloads MZ/PE file

Executes dropped EXE

Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2