Extracted

• • Target

    fccea4f3d6ebae2f1c65af24a68585e8170c3a0e60cfbb0a639f02345c1a3098

  • Size

    217KB

  • MD5

    f771ba77542c6f19cade962fb4543ab6

  • SHA1

    2f8844c1d368bce620a2761b35288498f51bc95e

  • SHA256

    fccea4f3d6ebae2f1c65af24a68585e8170c3a0e60cfbb0a639f02345c1a3098

  • SHA512

    9dfcfe72a5c43ad395b290c04dce71f4b8a27a2cd1bd24b01d5fd5923f5b2dc02702f964b081113a0bc1d9b236340e161f0adc16f947a0968bc9e6ea835ed4fd

  • SSDEEP

    3072:h/EphVY6tjOSazEGm7cgiL7VG6naXkFALxFIPD4Xu0wtabJM9wVTjuJ+EjaL:hMps6xGmQnL7A6nW1aPDWBJM9wVTbr

  Score

  10^/10

  danabotsmokeloaderbackdoorbankertrojan

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Detects Smokeloader packer

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1