Extracted

• • Target

    lchosts.exe

  • Size

    6.1MB

  • MD5

    918353ce3730bc8dcfd94bfade41e6f6

  • SHA1

    0db0ce7231b515cc856d379b3e32fd39f15d713a

  • SHA256

    70e97b1be94a6abcdfbd1bec5a5408cb6ed3a544a21ce5a00554779787c22c60

  • SHA512

    77752bb2c2c83adf0e876c9c1155774f4c0783a5fb94dd05d42af117f1f1fc0341ca2bf0d98c66abf0ef4d3967ac6fe7f84996c59817d94366549c1a48c70dc6

  Score

  10^/10

  danabot3bankerdiscoveryspywarestealertrojan

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Blocklisted process makes network request

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops desktop.ini file(s)

  behavioral1behavioral2