Extracted

• • Target
    2c5ea723530fa9428e3357bb89f9200a7fa05dedfb3c9f1454acbc27751c8056.js
  • Size 5KB
  • SHA256 2c5ea723530fa9428e3357bb89f9200a7fa05dedfb3c9f1454acbc27751c8056
  • MD5 3ea6a5b6a66f68406043fcd05e822c9d
  • SHA1 a98a28227dfe62e05797fa1bb17cee2373ed8927
  • SHA512 59bc15bd74272938dad55e13f9dbb0170e57e40e19cbc7ce86f013ca3028b4d96b00365a657767d4c0c40a89d56ba9f9a2fc90936b267a1947c7b5440b7aee21
  • SSDEEP 96:kWoxJJQmALrN080J2mkpIVXRCyKObJo9BeQrFsvn4DAz9MUmd99WL+wHWDX/KBnk:VoxJ0czeIVkJObJo9BecsvgAzHm7sL+Z
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  danabotbankercollectiondiscoveryspywarestealertrojan

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops desktop.ini file(s)

  behavioral1behavioral2