Extracted

• • Target

    b6044f9ec3560bbbfa3ea4d2300e6a03df446b33805d06e8c4d73162e5d9a02e

  • Size

    1.3MB

  • MD5

    f0c494e386eee0c623b4a7685f01916e

  • SHA1

    0ad286248fddf6500c01caf659736e737e0b7e9c

  • SHA256

    b6044f9ec3560bbbfa3ea4d2300e6a03df446b33805d06e8c4d73162e5d9a02e

  • SHA512

    de03f3daafda3c0ab8604e5cb5fdfafa83ee8e136b5dac9c375b99e1cf452aa0afd310239663b27c7b38b287549eb8b4cc057ba7b771e30ca064efb7f4e5962f

  • SSDEEP

    24576:2GgQbyym/cA+QtEsBaJGhuk3gd5nlmkOYHgjDHpDXJ6aYg+f5:2UK6ScM73KOYHgPVJ/H

  Score

  10^/10

  danabotbankerdiscoveryspywarestealertrojan

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Blocklisted process makes network request

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1