Extracted

• • Target

    6acc0714d3cbab8c42b03d03044f0c56134ed9a651bd1f7a88d8c8f56c978f6a.exe

  • Size

    1.1MB

  • MD5

    fa43013cb8f1c2548f1ae8e73ff602ab

  • SHA1

    6ff459d4c88b399c0f54c83659188380a322bb99

  • SHA256

    6acc0714d3cbab8c42b03d03044f0c56134ed9a651bd1f7a88d8c8f56c978f6a

  • SHA512

    acb3b6c8629d875d05740d0307a42758c49bd288e342f5fefe38056053104a8616fca73f9a6b94f2ef93be2e043bec2edf1c9e165249824f65c8e8ec56e5e297

  • SSDEEP

    24576:uzjX1tNkven7slbDiEqVSwJ9PioVFYKvWegpR9wI:unXPKvC7sMEqPJ9PiyfTq

  Score

  10^/10

  danabot5aspackv2bankerdiscoverytrojan

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Blocklisted process makes network request

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2