Extracted

• • Target

    SecuriteInfo.com.W32.AIDetect.malware1.32629.3499

  • Size

    6.0MB

  • MD5

    7b1ad0c4bb7e5bc33b2da7ebffe86e6f

  • SHA1

    276b2ae7a851a06e7e026022bdee6d4113495551

  • SHA256

    345a564dd605f8d904c4f1ff4d3bf5686a9d88b9fe4b586aba4b23f45cffe297

  • SHA512

    ec7aa5d9f50bbe33421f59de774b00bc9cd8899be34a1c8fc7ee09935e255ff4c50904bd019d67a57734e5852eafc19e2815e9a6be53ce97f796bc65fd7276cd

  Score

  10^/10

  danabot3bankerdiscoveryspywarestealertrojan

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Blocklisted process makes network request

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops desktop.ini file(s)

  behavioral1behavioral2