Extracted

• • Target

    815c3358140660944f5f68ecfcee25a0.exe

  • Size

    6.0MB

  • MD5

    815c3358140660944f5f68ecfcee25a0

  • SHA1

    2f3459256b7d31278350b15f61c7a8586e3f226f

  • SHA256

    7b1c3945ee7336c1cf4231e0022ef3ba4cf06f5b0a9a9cf8fea3c8c2d346c760

  • SHA512

    bc7fe4ab191bdb5eba3a4a27b359cba19927bf231c7d07127b1594706c2cfc8b0a428c7f92c20fd7493f21264ef817ebe7503d3f0127146337ba50ac9771caac

  Score

  10^/10

  danabot3bankerdiscoveryspywarestealertrojan

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Blocklisted process makes network request

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops desktop.ini file(s)

  behavioral1behavioral2