Extracted

• • Target

    file.exe

  • Size

    146KB

  • MD5

    5857452a7c4f42e1be84602d6fdd5de4

  • SHA1

    031694f1a68eafa3915c886d6dba4c2034c7bea1

  • SHA256

    9d95e51bc6240a1e42b4d7ac35f3949e98bc2462cfd84ae3180b3d3753d6fd32

  • SHA512

    13d50804f489bad9340716ae7c1fb1a779e3d09917afc9bbf31d108f02223cc7295ca0d3e5b0c687e3d6d8d1434636a285743eda424e59ab5afd0223e500196e

  • SSDEEP

    3072:KIkS00hfhxLbvCTQXMfJZjLIyUMe9a+BPcBaGO:VmYHvExZjLhe9zB4aG

  Score

  10^/10

  smokeloaderbackdoortrojandanabotbankerdiscoveryspywarestealer

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Detects Smokeloader packer

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2