Extracted

• • Target

    83199c20486d9e4275b97bbbd5e32a6d462ec2cdb7e81c08e7ec47fb7cb579d5

  • Size

    255KB

  • MD5

    cc3d3018fa2079d733922d142d5d0c87

  • SHA1

    ae74486c51333061e74773c66401456148b22435

  • SHA256

    83199c20486d9e4275b97bbbd5e32a6d462ec2cdb7e81c08e7ec47fb7cb579d5

  • SHA512

    24118058a6bcfe77d0faf84bd05ecba9fb559885d0090ddde006e379025455f02899c98eda5adafdcbd496af60cf818e8978221964e441e412497c882118d673

  • SSDEEP

    3072:PXiLK/tIeg8dqpDGdKXRf04V5xbObCmdEHuJ57Jhb2L9trNvOVlUVUWsl2WFsrbF:/b/tiadU04LGdXT2L9trNvOVlUVIc

  Score

  10^/10

  danabotsmokeloaderbackdoorbankertrojan

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Detects Smokeloader packer

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1