Extracted

• • Target

    081d7f5bb4494cfa0884dd71408f668406a997584fe42f7da652a50471646e94

  • Size

    4.2MB

  • MD5

    c6d8d381427edcdf21540c0793744363

  • SHA1

    f219432c9b637b1f2f34db3a52812dab34f57a96

  • SHA256

    081d7f5bb4494cfa0884dd71408f668406a997584fe42f7da652a50471646e94

  • SHA512

    004fee959cde67e44363d9218b75abd08bb30d11f24c7edb287557e744632ee9a10db4266f3f88c96e7e47d7871ab562073ebb9d263f1fd8ce0d94f62b970106

  • SSDEEP

    98304:/b/IVFOgzb0Rd1WE8DIAmv5KX9DiDa++czw1jN0qgfZY+y:/Oh5E8DIAmv5KXtl++czw5N0qMD

  Score

  10^/10

  danabotbankertrojan

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1