Extracted

Extracted

• • Target

    e78d09e4b3b67ee6daa67a2e56af5f86.exe

  • Size

    706KB

  • MD5

    e78d09e4b3b67ee6daa67a2e56af5f86

  • SHA1

    cbf392057b31e7a9efb2ac0a3de150997eff6367

  • SHA256

    ca466b470e363aed1f3cf597e060862335d22bf6919bc7e9518fbe80f3631f15

  • SHA512

    c4c49b320537b3eaa6d49d56b008db123c04cf99fb1be87b9f5d682839abb717946526f5d3bd35551b3921732dcd5454b4f773e4f351e98942ced5f19cf31e80

  Score

  10^/10

  cryptbotspywarestealerdanabot3bankerdiscoverytrojan

  • CryptBot

    A C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • CryptBot Payload

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Drops startup file

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2