Extracted

• • Target

    0b727a2f45073dfbed3c2096aed86c3631372ad56f763dedc6b7f59152d1e094

  • Size

    2.4MB

  • MD5

    8bcaa79c45d51a44dc6a05c4b8cf4114

  • SHA1

    ccd28984173d63dc50db0a4a1c8ffee96dbf30a4

  • SHA256

    0b727a2f45073dfbed3c2096aed86c3631372ad56f763dedc6b7f59152d1e094

  • SHA512

    bdf68c5feadb5e31f3bd34e0e93cb93631fcee9ef9a2181d4cddabf2732dbc922a31a5a889ba209f91d826143d992e38f02e45c115c168b7f6fd884ef576bba3

  • SSDEEP

    49152:pB7gGuhQPiM5QuHHzMr0R682FRZy6Eao2LXMeEiBRgy3xrDkvYB0IqSy:pB8KPZJzMrMW06g2DMLiR3x0YB0vS

  Score

  10^/10

  danabotbankercollectiondiscoveryspywarestealertrojan

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1