Extracted

• • Target

    7abaebf4d3807453b2e2a0ef250101b1087e291010b9f69124272af30f540d4a

  • Size

    193KB

  • MD5

    c1bf74789ae95f35dcf98ab453acbff3

  • SHA1

    78cfde9b320ad6ca9219e7221e2b6342fb13ee63

  • SHA256

    7abaebf4d3807453b2e2a0ef250101b1087e291010b9f69124272af30f540d4a

  • SHA512

    38e8f2d4a4731b55fed60af7a0e102ccdaacfdd3dd204a53d2e0573cd19c66adfa6ae889e2a016bfed660db278355ebfd47dd81acdac73c502cf9d4bf1fa0f00

  • SSDEEP

    3072:yXOJPDLgYNWsP5je8DWkBOpGb88uqYr0Kj0oXM9G+k:y2PDLzNkkWkaFqYr0LoIG

  Score

  10^/10

  danabotsmokeloaderbackdoorbankertrojan

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Detects Smokeloader packer

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  behavioral1