Extracted

• • Target

    26b76e02a3c17266db13ede01234f998d40ca6c26d3b245fde268e3a26f32c8a

  • Size

    1.3MB

  • MD5

    77ab6e4c38323e6d681dd73aae1bb939

  • SHA1

    35d058f859705ad65490db829ba0a0b9546b0934

  • SHA256

    26b76e02a3c17266db13ede01234f998d40ca6c26d3b245fde268e3a26f32c8a

  • SHA512

    091b8a8b213df8da8eab3b8b463570e5a5ba2d952e85e9c11a9a557fb6ff4c651b0358a22604d59ff7b433ec5f06e50cc0ce6b883d6050c749d65fe73e360e58

  • SSDEEP

    24576:4Ym8y19MPo1Y+h6f10PsMEcje93m+orEcgS1tgjm3V:4YOXMyZh6fCsMEIe1Now5qg

  Score

  10^/10

  danabotbankerspywarestealertrojan

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Blocklisted process makes network request

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1