Extracted

• • Target

    Muse_Hub.exe

  • Size

    42.8MB

  • MD5

    f6a5eeafe3927f8b60edd4710f472526

  • SHA1

    90990dc31a9ce75456d68653309e4b37291bf54e

  • SHA256

    777516469e953cb8ef945f558388aa27a4bb0e4849d35295a54fa9b104916c73

  • SHA512

    03efbe3004b1434fa13e230b1c8f8526cfafeb94ee6d9a4e1b65ab316d183e86c39d1af0def4a48d3d65d186d5f7b3c76352b57ae40288e9171893ca58c9f4e4

  • SSDEEP

    786432:WxfDPC5XlW/BIWj9Tp+V9w/PHyNmG3i+QpNT0Oxwkyh2YvLYpv1A8AmZ4HEleUau:WxfD6yaeYV9EKNmG3iYOGke2+0nA8AmR

  Score

  10^/10

  danabotbankerdiscoveryevasionransomwaretrojan

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Blocklisted process makes network request

  • Disables Task Manager via registry modification

    evasion

  • Drops file in Drivers directory

  • Downloads MZ/PE file

  • Legitimate hosting services abused for malware hosting/C2

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2