Extracted

• • Target

    8456047c641f95d59a831bb7c219adc9ef8d367cc602519e3e4c7dd920923a05.exe

  • Size

    18.8MB

  • MD5

    f99c6dd8e8bf98b8b8c1e041e25b5983

  • SHA1

    f24d240adcf80d64a886ad75ff6509a6465e232d

  • SHA256

    8456047c641f95d59a831bb7c219adc9ef8d367cc602519e3e4c7dd920923a05

  • SHA512

    8caab0615c340752e60d773d78a1a91bb861536fa96f48b6d09f031bd12a950ce0b554ec114d0f3e114e8aeade97b6981d617c8acb99fe0081d2d3529fb723b6

  • SSDEEP

    98304:ticU/ooWRbog8zGnUVB1ucXzVcQedKvPaW7IXHUcPUljpYp/pAYA6dw3:09VBocXzpPl7IXUcPUlFQA

  Score

  10^/10

  danabotbankercollectioncredential_accessdiscoveryspywarestealertrojan

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2