Extracted

Extracted

• • Target
    idapro.exe
  • Size 327KB
  • SHA256 3b14f10b8cd5c55d405785829bf2e8e4917fe1ac432ec0a376b2b4621314686c
  • MD5 0ed74836af595a75d959e703e98f3735
  • SHA1 f48fe1347528b1bcc210a90c60e93300ddfb1c31
  • SHA512 dd5bb6e6c2674b8b2de6b22c0f7cc051303592d0fd50e14c8452988646760c907c9650e5b7ab594027e01faa9216f2b865b5ab015f34d92e62d51373f8152fbe
  • SSDEEP 6144:UsLqdufVUNDa+anxutqrmxBpwrWlTKh4Qffn2n:PFUNDa+axuS+waZ84
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  danabotgandcrabbackdoorbankermicrosoftcredential_accessdiscoveryevasionpersistencephishingprivilege_escalationransomwarestealertrojan

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Gandcrab

    Gandcrab is a Trojan horse that encrypts files on a computer.

    ransomwarebackdoorgandcrab

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Renames multiple (524) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Blocklisted process makes network request

  • Disables Task Manager via registry modification

    evasion

  • Downloads MZ/PE file

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2

  • Detected potential entity reuse from brand microsoft.

    phishingmicrosoft

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1