Extracted

• • Target

    5d580ebb6471dbf5a504c7f7e112d6e1.exe

  • Size

    6.0MB

  • MD5

    5d580ebb6471dbf5a504c7f7e112d6e1

  • SHA1

    8bfa4d1fd72185c854e303fb4a7430ae2a548afe

  • SHA256

    4b66dd3b1e34308243c05094cf7b8e320f83eb453d58b80aaf9059fade40fcc1

  • SHA512

    22e4b9caaaff0e00237bbac55a9043e3f374dadcaaaa0894e16fe81532c2d226d2752159fa42f9caafded3eac15b143bcea1d1439133ad22fea29b80b9da88f0

  Score

  10^/10

  danabot3bankerdiscoveryspywarestealertrojan

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Blocklisted process makes network request

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops desktop.ini file(s)

  behavioral1behavioral2