Extracted

Extracted

Extracted

Extracted

• • Target

    f285d73bd5968980953e2854d572dd955da3319eecf8127f5e81aa07e9421726

  • Size

    213KB

  • MD5

    2141c84aab4a7591fb50e4fd24a9c2a7

  • SHA1

    bab0bd15b12cb785b03bd0a09c603e9884bb5c01

  • SHA256

    f285d73bd5968980953e2854d572dd955da3319eecf8127f5e81aa07e9421726

  • SHA512

    9f4e6bb793f76fec7f7224e4c2f23f14eab6c1978f1ae5af65ed30b6c8ce6fd8bf0218435f7a7eed03594ed9ed9647cbfefdc29a30c5a186907c48cd4ae8afa3

  • SSDEEP

    3072:p/Qlt+LXk2t8aTR+QOSqxioydbwwSKBjf+QmDKkLszbZSi40zwUzQRKF+:dBLXk2ohioyd0wSMf+rDTgzlSi40M2b

  Score

  10^/10

  danabotdjvuraccoonredlinesmokeloaderec7a54fb6492ff3a52d09504b8ecf082mario23_10backdoorbankerbootkitcollectiondiscoveryinfostealerpersistenceransomwarespywarestealertrojan

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Detected Djvu ransomware

  • Detects Smokeloader packer

  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

    ransomwaredjvu

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses 2FA software files, possible credential harvesting

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1