Extracted

• • Target

    65a8aef7cc1af8fb54964fd984b19745.exe

  • Size

    6.0MB

  • MD5

    65a8aef7cc1af8fb54964fd984b19745

  • SHA1

    93076eec782044cce69e475480d5901d8f233cc3

  • SHA256

    8d7e3a7ac66630ee4d2a9041dbb6cb6b10ea07e1f8ac32426489fed7ecc7d4f9

  • SHA512

    f916c6eb8359a24ebc6f7f8031a4cce8fd7ff865b4e30a45fb2da7a8ea3e771cc3cd92683f39aa327eb8315631d7581fa632bf7431484ccd216585218921a56d

  Score

  10^/10

  danabot3bankerdiscoveryspywarestealertrojan

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Blocklisted process makes network request

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops desktop.ini file(s)

  behavioral1behavioral2