Extracted

• • Target

    OIP.jfif

  • Size

    10KB

  • MD5

    b93d7afe4b92832b106532271746ee11

  • SHA1

    98b7eb52a84a31338af5789acbaa2ec6aa103d37

  • SHA256

    10ae7bc76a6d12d1a278156b9e949850262c2fd516e54a55a1e5c2264f2bc835

  • SHA512

    f6477f5e45ca5d1738e719809f5edb65bf82e54e1d6aa6a0cebf1054875c5d6f1a13dbf4f29e34169f65fe6e132c28e44a74fbdaf4a05793f4f55e8e086b22bf

  • SSDEEP

    192:NTy1njwHoxuxq+H+yXD7CE5r4h3laN+bTONzVKG4FO2i4GwHk9ww7c1iSGO4:NgmU+H+yXD7CS4h1aN+POeG4g2iHGc7X

  Score

  10^/10

  discoveryexecutiondanabotbankerbotnetdefense_evasionevasionimpactpersistenceprivilege_escalationransomwaretrojan

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Danabot family

    danabot

  • Danabot x86 payload

    Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

    botnet

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • UAC bypass

    evasiontrojan

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Disables use of System Restore points

    evasion

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Modifies Windows Firewall

    evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2