Extracted

• • Target

    CRA_INV_2019_552913887418/CRA_INV_2019_552913887418.vbs

  • Size

    24.2MB

  • MD5

    3818ef620d826c62136f450c32429ae5

  • SHA1

    1297b772ec42586ce1c6db624e8948cbe265710d

  • SHA256

    38c668144becb1199196394ad78df6694c86597a283aea61bd036dc1da2eef62

  • SHA512

    9789441d9a76f62213ce9889422241c6732ec21ab4ddfff4b596136d327d393c03f8c2f0973b07fd88c7d21c1149d1418d3c153b6b802562ad4b9035ebe78c00

  • SSDEEP

    6144:Xuqc48TgRr+iPNUvl2bXZF3HCqyURNcZV0N5pCO4Mt6pQi:RXr9PNi2bHKPQi

  Score

  10^/10

  danabotbankertrojan

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Loads dropped DLL

  behavioral1behavioral2