Extracted

• • Target

    lchosts.exe

  • Size

    6.0MB

  • MD5

    1c9ed680c8f20831f7b4971864b6d0eb

  • SHA1

    75df662b750a83875fe49912f9b70609571eb212

  • SHA256

    e815e3fc60f7c5249254d411c983b93553b8e59832403093eaf25db133b2e77f

  • SHA512

    c55d486bdadde59da0766c7830c769a9bda8067fa816a9990a03e71023cad106199bfac81add03b902658bf1ade5936a210e947a488ed40e55bb36eefcdb0d34

  Score

  10^/10

  danabot3bankerdiscoveryspywarestealertrojan

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Blocklisted process makes network request

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2