Extracted

• • Target

    3df0a041551e82f2c84e56c36de75c3f.exe

  • Size

    6.0MB

  • MD5

    3df0a041551e82f2c84e56c36de75c3f

  • SHA1

    d3e0a9050e3d11e3b76b491338e42a3655b280cd

  • SHA256

    f01d195f4dbf1e4be25a170eba29671d2d7923888028bceb3895cdcb3641b216

  • SHA512

    ccb5ed9af4da5e67eda57864a336eb9f58a3c259a4c8cf526c8e2fec2cb5f75b81aa65047250ea62b4d0440e6494dd28ac4104ec780adb148a7748fe70383e54

  Score

  10^/10

  danabot3bankerdiscoveryspywarestealertrojan

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Blocklisted process makes network request

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops desktop.ini file(s)

  behavioral1behavioral2