Extracted

• • Target

    c044ffcbac6f16c4322deb7957cc901c.exe

  • Size

    1.3MB

  • MD5

    c044ffcbac6f16c4322deb7957cc901c

  • SHA1

    36234162600dcf2730ba01e07125dc497bac74b7

  • SHA256

    93582891bce408609f20af2a38f181e77b8134cc3a87e0fd887edadf29be6373

  • SHA512

    d48ca582f20bca1e668c06d5a5616933c5bc38287bbc64715d506cd10d387eeec106f2a0669e74371351b95f324dd5cafc5c90d4aa5dea35a41a2ce9d143db0b

  • SSDEEP

    24576:Q4wlY+1ZBpNIuDdhcOvNtnsQVB4Ak7uMdsLd1XBktTV7yUX9rl:QRlYcZBDvXsmk7l3WUx

  Score

  10^/10

  danabotbankertrojandiscoveryspywarestealer

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Blocklisted process makes network request

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2