Extracted

• • Target

    0576a006b827b641764898dd0587a8a0acbdc0b217e983cce297a727f3f3cc85.exe

  • Size

    6.0MB

  • MD5

    7a43be00bb3ff76da6c777999b1c4f3a

  • SHA1

    ef82fd1f589eeadb54bd249d93c6370370924fc4

  • SHA256

    0576a006b827b641764898dd0587a8a0acbdc0b217e983cce297a727f3f3cc85

  • SHA512

    44b3c591289936de5c6fbe23f2fbad2de84b7406fa1ce861648cf8bf6c73d8dadd46c03676819ade9718e0cfa601d051a952c3cd9c89d4390b01605c57d52134

  Score

  10^/10

  danabot3bankerdiscoveryspywarestealertrojan

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Blocklisted process makes network request

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops desktop.ini file(s)

  behavioral1behavioral2