Extracted

• • Target

    CRA_INV_2019_846355810414/CRA_INV_2019_846355810414.vbs

  • Size

    23.2MB

  • MD5

    5dc77349a602cc631e123a686bf4d0c3

  • SHA1

    fef0a2e8bb2a6585bb83abbf5243c3acf0471cfe

  • SHA256

    79caaf23c2436d5d8ba5bba37c4e95022c78840b8278532d2348a5d3baf26418

  • SHA512

    854f1c662dd9955807848d41dcf9898e903c7665f698d93dd59e53dc4575feabdbda381cb9b3d77ed0db82ca4f076e2f63730c9cf497cf6426f512612d96a838

  • SSDEEP

    12288:vR44ehC8yM1Bo1xdZxYx11OsxGLnnY8+ubxihdPt4WzS/nfyDAcXuAcePYADj/Ym:PAwQuTw

  Score

  10^/10

  danabotbankertrojan

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Loads dropped DLL

  behavioral1behavioral2