Extracted

• • Target

    e5feac9da811296081b00f656320faf4ff21c2a7c62b154852e0d4718e4c77b5

  • Size

    214KB

  • MD5

    a6400b3a3e6e7c26ad46aaa641525d78

  • SHA1

    de95f3d6c9cc61dc7d7fe420f06dab11870b22c1

  • SHA256

    e5feac9da811296081b00f656320faf4ff21c2a7c62b154852e0d4718e4c77b5

  • SHA512

    076945103127eb9616848db840400a2f1607240e8f92be167074facc860e26c6754e7526a22438c1763535c97c2c0c550a4a825f5190bf0023edc7747d6b4c26

  • SSDEEP

    3072:YXpssZHJML2FYAg18P9MJ5J2U2h8Y1k45Db7Q7xGtP0KisgW:stZH6L2FHPSJ2qY1k45/7WwP08

  Score

  10^/10

  danabotsmokeloaderbackdoorbankerdiscoveryspywarestealertrojan

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Detects Smokeloader packer

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1