Extracted

Extracted

• • Target

    4fc81ed7e14c996685d930fc25d89d0f.exe

  • Size

    743KB

  • MD5

    4fc81ed7e14c996685d930fc25d89d0f

  • SHA1

    9133156789a5b0d730c5d059948edc14bfb7ead4

  • SHA256

    1bf9a15445a908fdcd7d4a5a0584678a1efb086d1eccbf0ae60393f6be208919

  • SHA512

    aed4771ac1cf483045ec34dd3a791c87af0d04f01082f20babad8ac5af2d5d950de1a7da040f76eb1a39f5a89231e90c33e5cd4aee98b6da97811e48ba518aad

  Score

  10^/10

  cryptbotspywarestealerdanabot3bankerdiscoverytrojan

  • CryptBot

    A C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • CryptBot Payload

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Drops startup file

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2