Extracted

• • Target
    98d925ffcbc068e4147f20a9aec44f53.exe
  • Size 145KB
  • SHA256 2b87af7e76296ae9e19077e4e3f6b5e7871fd90e7df41e693853987dd53470c4
  • MD5 98d925ffcbc068e4147f20a9aec44f53
  • SHA1 e784498a594159a1a3fe63d33c35c1411c94269f
  • SHA512 315232afc061f96a9c6529da45ab1a3b66cd4ef80950b79b77dca55fa12cb11213fb1f2ad2cdb958211a780015a5cb81fd30e11aa05fbdd70766acffe157a900
  • SSDEEP 3072:1P22aLkVvEEl9DkxwlV+aGsu4d8rOiCS4rF5gG/et8SO:1PiLyv7DkxwTXFuA8rOJS4rfl/e+S
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  smokeloaderbackdoortrojandanabotbankerspywarestealer

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Detects Smokeloader packer

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2