Extracted

Extracted

• • Target

    b459692e802efcbc858497ef0d54eb5f30d2ae75e703d.exe

  • Size

    716KB

  • MD5

    4d8805c5c4e7197d6b90b5ec1827c068

  • SHA1

    bde56cd30d7866925626ba14c01528150c9ab8a5

  • SHA256

    b459692e802efcbc858497ef0d54eb5f30d2ae75e703d4cb85ce29d895adc911

  • SHA512

    c4d4ea665f96f1efb8e0218fb64f1c4f375d3faeebdb935b60867f65f55bf18cd96f6a7aa0ea5758144607f8270ac66a718342cb1e78e8442fd1cdcd116ebe44

  Score

  10^/10

  cryptbotspywarestealerdanabot3bankerdiscoverytrojan

  • CryptBot

    A C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • CryptBot Payload

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Drops startup file

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2