Extracted

Extracted

• • Target

    deploy.ps1

  • Size

    8KB

  • MD5

    8204fecf61d58baa25cea9e97c894bc3

  • SHA1

    bedf0300880e5f5cdd1643abdff6789ee50db35a

  • SHA256

    0e284d3446eef106b1557f50bbe83bbeda4557476bb88b89fcc01195db83d4b1

  • SHA512

    adc06b854f77734396fefcbc1c319efdb00f30c694a836ce721f5b91364533c410d40c5a07ef68d83d5e5e17c31b074009bc2a2b8823d0c1fd5eb7fbc73c43ea

  • SSDEEP

    96:LmbW8Mf47p7qCgr2CpXlwHZt3pXl4Cj+r1osIPjiTYSKYWrrG8cDd:Lmb4f47VHG2tt4osQe4Yg8J

  Score

  10^/10

  dropperexecutiondanabotbankercollectiondiscoverypersistencespywarestealertrojan

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Danabot family

    danabot

  • Blocklisted process makes network request

  • Download via BitsAdmin

    dropper

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2