Extracted

• • Target

    file.exe

  • Size

    235KB

  • MD5

    6a70c8ff0b09cc809fa362398e18b3c2

  • SHA1

    77011a9774d30c2aa71777ef756b217442d57564

  • SHA256

    f331a3b1ab03bd227de9722bfc16dfaf0bdf8a692995ebc868c711c08f664b9c

  • SHA512

    87f3a3fd21850d3175ef9af86f6e7a4cf2d5fad410726a48d6a12bce0e80f9dc423e7b9a388a3341386aaae39479902fd0e41c133707d9ffd2fbbc363b09e139

  • SSDEEP

    6144:eLhyLd3BRfc5wE2BO4IQGkRQmFstTtTHX8qMrc:eLhyFPQwLE4I1kjFsPT38n

  Score

  10^/10

  smokeloaderbackdoortrojandanabotbanker

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Detects Smokeloader packer

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2