Extracted

• • Target

    6843e9b84284b74e34dad59595a18637937671050c786fae7847eabb4b63f8b3

  • Size

    225KB

  • MD5

    867f3cc3fec8eb835ce43577d208454c

  • SHA1

    441d9bfccfb833adb3ef54319c724ffda5a84c83

  • SHA256

    6843e9b84284b74e34dad59595a18637937671050c786fae7847eabb4b63f8b3

  • SHA512

    adfe4cbfc292acf289c0d4f6ef87ba90b28c7b56906020e0ae6b3cc5a27839505ee304488748d8362342903e0e1acc5ce14983ef0b3c5bb96afcf1dbef8a3295

  • SSDEEP

    3072:mUXpWwHQLpVAYpBNe5lBs1P1J1wc22Y/38KdO79m0K80ZOCWgkZWH+UuS:fPHQL7BN/Rm/sK8Zm0c92aHuS

  Score

  10^/10

  smokeloaderbackdoortrojandanabotbankerspywarestealer

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Detects Smokeloader packer

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2