Extracted

• • Target

    SecuriteInfo.com.BehavesLike.Win32.Generic.vc.4956

  • Size

    2.6MB

  • MD5

    4a1c3c28361ddbf3bb561482fac48a13

  • SHA1

    c68d711aa133dab19ca4e8a0b75b6a9230d7b8e6

  • SHA256

    2aa79c5cfd9e657abd3eea42ddc3b31d44123e4fd14be4d4bcd7057b036c169b

  • SHA512

    c40de41edac45124e65fb246a92db686c8e4f8a7c6e0b3f04215ac63f1ee40dccaad74d179289f0ca019c4b4b0b0d0b60a1c3ac0f80dab59c8c0856bf661bb43

  Score

  10^/10

  danabotbankerbotnettrojan

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Danabot x86 payload

    Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

    botnet

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Blocklisted process makes network request

  • Loads dropped DLL

  behavioral1behavioral2