Extracted

• • Target
    file.exe
  • Size 214KB
  • SHA256 451ec0852088a55084102632e636204feef0989fabe57dc0cb602c4173dc48fa
  • MD5 94ce7e3bc61e8f5825b3416dccd1c481
  • SHA1 699b3330bbcdb08df4e5ee3c4e2343b33bb957bd
  • SHA512 1caf1d8d4ebdf2caafa092484d03653823c85e394531cea2e00937f5b38c75fe17b1ba86d810bdc6f95f0e5b0d8f6b21afdad260f278331e211095262649f8e9
  • SSDEEP 6144:Lf25OL4bdsVV2jEjxrxwRGgg3CwVpU0VB:Lf2AUxsVVQEjxfvSwVqO
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  smokeloaderbackdoortrojandanabotbankerdiscovery

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Detects Smokeloader packer

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2