Extracted

• • Target
    4dd049a7eed3cd13f0aef8270c0d04e9.exe
  • Size 215KB
  • SHA256 73a9cb67da90dae4ee505f8dd558b0285d12e7f439a3a1b6859607c4c16031ff
  • MD5 4dd049a7eed3cd13f0aef8270c0d04e9
  • SHA1 94ea68a912674f34be38839914bd8f1334da7ec5
  • SHA512 cbf57dfbec5cd8b14a3ca801ccd31d79a4907459916890f47f2d3330f3b03c7b22903cb2a5423f3fe5c2660cba0494d6681df8011e64a2923b33717caffaebd9
  • SSDEEP 3072:Su+AxLvJz40RF8jXNaI9B0bDus2B49d6S7hoLszZybxCL40zwUzQRKF+:PlLxzb8j9aITp/SCgzs9s40M2b
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  smokeloaderbackdoortrojandanabotbanker

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Detects Smokeloader packer

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2