Extracted

• • Target

    vpn.exe

  • Size

    1.3MB

  • MD5

    bdbb82acdd6ea587bb10ca6b2e41fa6e

  • SHA1

    e3a3795234acc91a711ecfe5e171777fe9a79458

  • SHA256

    bc0ded251a44cc8a1240e278143cd6071904eb1d0fe12d8e6f8d8879f85762f5

  • SHA512

    268862c7d1e7917b7a919781c381ca9b3177c8168de2fb1eb2c8c02d2bfa9eb86bf514713ef5695efd49c28f7bb2d74c3bc60075a1332239171b244d6ed4e1b6

  Score

  10^/10

  danabot3bankerdiscoveryspywarestealertrojan

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops desktop.ini file(s)

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2