Extracted

Extracted

• • Target
    file.exe
  • Size 272KB
  • SHA256 090cb19f8745e669eeb19d014ba18abdf9b447f1a2519b15569558bfb079bf6a
  • MD5 dc37acf1e69f7bf1ea417c9f408e0abf
  • SHA1 c6333d1ef0302a4a536899aefbe58264f575b481
  • SHA512 91d43e9f49f19935bfbf31218dfc60428981fb27db525e431bfca9b3dcac6f94bd6070aca60edce985efae948c5fc7aeae57a5f52f7b8c2fef337f38541ad8d6
  • SSDEEP 6144:10fqNSLXc1X5SHuImlcuzbgwuLW2DBIeTwVf:1kqNSjc1XQm2unni
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  smokeloaderbackdoortrojandanabotsystembcbanker

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Detects Smokeloader packer

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • SystemBC

    SystemBC is a proxy and remote administration tool first seen in 2019.

    trojansystembc

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2