Extracted

• • Target

    8c9143ae4670b98579f711c960206fe0e20386e87340188c1c37673545ea3d9e

  • Size

    267KB

  • MD5

    f56a6b0c5dece27be9c0dfcd5ba3dd05

  • SHA1

    1f44751fe41663d9b3f5a0fec658321ec962acc5

  • SHA256

    8c9143ae4670b98579f711c960206fe0e20386e87340188c1c37673545ea3d9e

  • SHA512

    fed3dc8971c1bf39d34fb330d0219380bccd4030f9740883fe89105abe9517b11f434e5330dd0e03db68b1d2415663c7de61c64be77c79476ba51eaff875cbb9

  • SSDEEP

    3072:YXIEuKOnkmql6N2x5ceSle3BnwKB5Xmb2KTncL60PwPT0WrxpzbgqruhA5QKWuDq:s+ol6H6Bf7McWLPT0uzbgwuhAgIwVfU

  Score

  10^/10

  danabotsmokeloaderbackdoorbankertrojan

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Detects Smokeloader packer

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1