Extracted

• • Target

    06f52b68331a1a95c64073eb588d5bb76a372c729d90468d5027593d8a5450e6

  • Size

    231KB

  • MD5

    d45062e43f4e6996c770cc94dc3724db

  • SHA1

    51eeb4dbba45e40585a05f5cd207abf36e54113e

  • SHA256

    06f52b68331a1a95c64073eb588d5bb76a372c729d90468d5027593d8a5450e6

  • SHA512

    3f83210205595195d18ee7318c23b44268b7f64f1ec00533861dae9239bfb8ec167af88e55a8fb15301884b1e54b3e9ac7aca4e88d5aafbefc9e00a673db8ee4

  • SSDEEP

    3072:WXpWfaQl0qYlyvNa589SeImVmNK1uyh+Hpl30KMT4NH6fOi:+gfaQeMx7VmNIZYpl30Jaafx

  Score

  10^/10

  danabotsmokeloaderbackdoorbankertrojan

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Detects Smokeloader packer

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1