Extracted

• • Target

    AXO23516563548321.vbs

  • Size

    4.6MB

  • MD5

    9c2592eb51ea3339ee113d151b623d55

  • SHA1

    da4af1db47dfe8b257ac53f754975598bc8b1a1c

  • SHA256

    eb7289b966dadc5ea1f99ca35cde7fc4f2380426f632a2bedb98e26fea9d44f4

  • SHA512

    b5d3367429f1cd538b59dbeb75ed3b49f43f8a4419d6ffcd34ffb6541e2163e6470bba084e0ba8ed8c07df52a717a28125e29603c9ad168b7d91bca9fd0aca57

  Score

  10^/10

  danabotbankerbotnetdiscoverypersistencespywarestealertrojan

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Danabot x86 payload

    Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

    botnet

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Sets DLL path for service in the registry

    persistence

  • Sets service image path in registry

    persistence

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  task1task2