Extracted

• • Target

    sample

  • Size

    66KB

  • MD5

    01cb2e0a4f044050f5b4f9969eb2550e

  • SHA1

    689dbef019da4e208eb35b57c466cafa61d8fdd3

  • SHA256

    0747f7da279d65d3edbbf1b7720ae34447443797964db49c9a8a543e82fb9200

  • SHA512

    b4ad1d30432404ea91bb2406eeb56e66379a4e3576efa153e7019fb716fa3f99edd4022b8814e22def86c576abdc19d66fb71eff0350e827ce8eef41fb9136f4

  • SSDEEP

    1536:G69UFLCCwNieoupehNFZuSuWtWWxLRoH1r2jSpScNkEAqWRI6ZsnVJr+Y05avm6N:h9UFLhwjuRoH1r2jSpScNkEAqWRI6Zsf

  Score

  10^/10

  danabotbankerbotnetdiscoveryexecutionmotwphishingtrojan

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Danabot family

    danabot

  • Danabot x86 payload

    Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

    botnet

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  • Mark of the Web detected: This indicates that the page was originally saved or cloned.

    phishingmotw
  behavioral1behavioral2