Extracted

• • Target

    file.exe

  • Size

    270KB

  • MD5

    8e585d7c9fcc8aef9ab94febdc17de82

  • SHA1

    df345a065922b89243780b45d5fd8769a7e7b24c

  • SHA256

    a6650e8e5968e516505133725bc634c8d524c925bed6de04b068f0f25d469d2b

  • SHA512

    060a11693aa56a03ccc71a54b246264e87c5ce207cbd2dd75fc0e4667f238fa4a9ac163f59b9f7060e0a26b65a8bea81325f48f42785f480ac76b034c5d03f07

  • SSDEEP

    3072:EXhklC/qA0TAJ5MD4/Mb5pBMEcTTvrZakX+cePKOG7xysxkgaBChUpZa9uD6VdyE:A+l3cJ5S46YTQk7eKxviga3wVfg

  Score

  10^/10

  smokeloaderbackdoortrojandanabotbanker

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Detects Smokeloader packer

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  behavioral1behavioral2