Extracted

• • Target

    a9be462e37b2148b9939a3a3a6901b4c86e3b30a36c3716b3ca61f0f64df535d

  • Size

    213KB

  • MD5

    547019b16aa6ab99ad5637a578a89c98

  • SHA1

    959e17f397d6e377f61b3c5915639aae1bfcede5

  • SHA256

    a9be462e37b2148b9939a3a3a6901b4c86e3b30a36c3716b3ca61f0f64df535d

  • SHA512

    164ce753fd3f13199023d639054996108a7e0ce22a2ec8688991608ff216ebdddb11ce70ac3b5efd583d7a0d20d11275931e6bf35d7e8c831fbd1eb66a4f0e3f

  • SSDEEP

    3072:YXpkExLSFqjgpOtk5Px38yupHmwOIM3OinR20Ku4nr2MLO5:srLSFstkx38H6td20t4nyML

  Score

  10^/10

  danabotsmokeloaderbackdoorbankerspywarestealertrojan

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Detects Smokeloader packer

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1