Extracted

• • Target

    261f8b9ee047f2e9ff3437b55b228c50N.exe

  • Size

    3.7MB

  • MD5

    261f8b9ee047f2e9ff3437b55b228c50

  • SHA1

    b121fbabb9729635dc0f2f9f99c3c8b839d3589e

  • SHA256

    c833f5951c3e22b358388cb256676ecd44f38ae2025c0e48bb717200f5eced09

  • SHA512

    5c3de5b66c8852446fc9d6b4b218ac5073bb9365be387191ef69430027ce59fff0140482d58fb85d7890f64a974bbb236cd66bccd2bf867b1de59eb6e9d3580f

  • SSDEEP

    98304:A0GrDh3DM50y37vVpRMYRF8fmB+XmJsvfS8rw9YXh:ARh450y3zKYRWfY+W6vf3h

  Score

  10^/10

  danabot3bankerdiscoveryspywarestealertrojan

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Blocklisted process makes network request

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops desktop.ini file(s)

  behavioral1behavioral2