Extracted

Extracted

• • Target

    48115ae725c9ef3b5fcca8c7730ec6c7d51f6d8b6d97a.exe

  • Size

    735KB

  • MD5

    9f060133976d5fe32265a830ad80160f

  • SHA1

    e5c4ebbddbf655cf36596a71f7d8296a312503e2

  • SHA256

    48115ae725c9ef3b5fcca8c7730ec6c7d51f6d8b6d97a83efe6a74a8c3206b84

  • SHA512

    efaef957290046940d400d491a3de6a608ea1c212469f59dc5579c7b259dc809779890efd4174432d0ed16fc786bb53a8e4a122e339a730649176e71a82ad238

  Score

  10^/10

  cryptbotspywarestealerdanabot3bankerdiscoverytrojan

  • CryptBot

    A C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • CryptBot Payload

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Drops startup file

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2