Extracted

• • Target
    0a4aeb4dd0aa51ddbf5be869e05ca9cd3670d66d3ec43889c42cf32d791f2c27
  • Size 10.6MB
  • SHA256 0a4aeb4dd0aa51ddbf5be869e05ca9cd3670d66d3ec43889c42cf32d791f2c27
  • MD5 81f085b4c164d0b6d303e0c762a9c9a1
  • SHA1 6b1052da2540db7ba59933bad76c6a4b7048ee77
  • SHA512 eb8711744a070acf6930f9353eada772104fb06c16eb6b5acc32b8d25b629d851bc3f1a274bdf3d3cf664375d1d24e6ecfca77bf0fd0e08902fb8caa53b503ef
  • SSDEEP 49152:zwXkp+UqhFIZGpGq9Ts8+f0zzuQnKdm87PqvYocA+SnyX5emyoBLGnEBaxdk+otV:zwXkoUqhFFzXnQo48myrx8x5OS
  • TLSH
    T1C9B66B51F3B4C2A5C0268134A9A3A313F730B8594705A7CB5BD4AEA52FB73D06DAF316
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bankerdanabotdonutloaderloaderpersistencespywarestealertrojan

  • Detects DonutLoader

    loader

  • Family: Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2