Extracted

• • Target

    ec56fe2723f85dead33ab380ae1c2b30N

  • Size

    4.4MB

  • MD5

    ec56fe2723f85dead33ab380ae1c2b30

  • SHA1

    f0e046ae1724dd1edda6abbeed36f58c077568e8

  • SHA256

    f41d9ca984b9c4efb0f8c375d5393364376c3e0967417a2fdde1d7fddb048cc2

  • SHA512

    2b3a0ae0dc40aa37c94702fccaf91d5a6d37f4c92c19174de1c92fd7a70d0801cb763222704adc663242e5e46502ba7c323ab9489f75426afd7a2ec50a97f107

  • SSDEEP

    98304:iJl5IIkyXvJE9lp5VjZVv6+cA7Skv2APUo4ZjekK7RR/l2azvMgLAIThFNyM/qR/:UhkyXWdVVvKZsCazNLJ5dqJ6pkG5a

  Score

  10^/10

  danabot3bankerdiscoveryspywarestealertrojanupx

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops desktop.ini file(s)

  behavioral1behavioral2