Extracted

Extracted

• • Target

    0c415967fbc5864f72e16ba41661522e559b1fa448c55ebf00bfac49de33dce2

  • Size

    170KB

  • MD5

    893d4e27f1eeb13f20fc5e7ebfb0832d

  • SHA1

    ed1585707d6d1a600bdca0123e22a7ba41a5fb4c

  • SHA256

    0c415967fbc5864f72e16ba41661522e559b1fa448c55ebf00bfac49de33dce2

  • SHA512

    dc8b6469477dd1ca658ebc7b3c866ed37ae159a5dd75091611b1b7b373a1a594446ab249b247e2eba3ba900c10401b4878327c018d09bf6358b233944b88af88

  • SSDEEP

    3072:13q/POichgR35WFgtDhYodufaKBUtHq5x:dhHodufa5

  Score

  10^/10

  danabotredlinesmokeloaderinsmixbackdoorbankerdiscoveryinfostealerspywarestealertrojan

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Detects Smokeloader packer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1