Extracted

• • Target
    file.exe
  • Size 213KB
  • SHA256 4ec544ab5dea3f6392db3d122ef23becda3ed99d6468cd9d135a0f0f0fc56458
  • MD5 73363404936254f3431962a1e8dc98db
  • SHA1 b431e0d560aa9c95a0986d92fe4869444203e40b
  • SHA512 7fc237b4359de30b0339994ed20bd8f0c5692f8920e2e57df1ed5ea0e4fa573c27bffc9cb7f82c1e867d22f9561af92f12e8ace39d22380e2149b2f7c06930fa
  • SSDEEP 3072:0ORLjLAx+s6aTRVV2FFXaT+niviHCYoULszrRA40zwUzQRKF+:VVLAx+oV2ST+nPQUgztA40M2b
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  smokeloaderbackdoortrojandanabotbanker

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Detects Smokeloader packer

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2