Extracted

• • Target

    68cdf592d734d504d62b9edb87acbbf01b5ee9a3dbbf3ecc210917330f92e220

  • Size

    213KB

  • MD5

    3172224a07d21abad4088793928a93ff

  • SHA1

    0f240f43000377c99a22e9097168fd0e1430fd02

  • SHA256

    68cdf592d734d504d62b9edb87acbbf01b5ee9a3dbbf3ecc210917330f92e220

  • SHA512

    638a16b775570cb4cbd611c9a166366ab8676d9623fb8857b5c322ca794cdbf69d1bda1eaeebd160d230ef426455c6d452b0d6410afa3a9d9ec7701554822e4f

  • SSDEEP

    3072:RAFXpxfHsJhV6L5FZOg8Q6yB5FIS249/o8+ekpQiUyQdI00KqdKUVh5:RABPHwkL5FJ6yaSS1WiUDI00DP

  Score

  10^/10

  danabotbankerspywarestealertrojan

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1