Extracted

• • Target

    2301be240be82a0eb764b1ab72350bee.exe

  • Size

    6.0MB

  • MD5

    2301be240be82a0eb764b1ab72350bee

  • SHA1

    49e57811c57696ae094afa7dfd866e95af1a4295

  • SHA256

    30cbad20846a91025a064deba274103e7daf3cbd2e14e3dc4d72811be50d65c2

  • SHA512

    99f7f694ea39e9c8061fdfcc95ecdb26e7110ccb2dcaf725326e33dc7c9cf2607aa86f1c17de2f96efcc060386a52b22891bf5de01a144928f90e56263cf6512

  Score

  10^/10

  danabot3bankerdiscoveryspywarestealertrojan

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Blocklisted process makes network request

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops desktop.ini file(s)

  behavioral1behavioral2