Extracted

• • Target
    0bd68faabd1e1748e5ed0d5a7cd881f7.exe
  • Size 9.3MB
  • SHA256 80528e16c3d9e33bda933a88fd034d2a683f339778255a3006ea7828b4370675
  • MD5 0bd68faabd1e1748e5ed0d5a7cd881f7
  • SHA1 a61e1af710025a3788b7a6247b9bce0331788925
  • SHA512 f5c22e05783a50a9067d09cb2bb214115e9cbfee3315f9b2fbc17a9cc1c9fb79db9a6fbf7240c91a136981031d8a32a06ef3a9fc165d0bd0be962062c636ab43
  • SSDEEP 196608:ucBc0jLfTdeDqsBdwhf5aBaRl5RpT+5I7nvmy+qoRMG:ucBcmYOQ+hRaBajbpTKIbeSoRd
  • TLSH
    T13CA6011B7CE048E6C8A953364A7641927B76FC490B7573D76E40B6B83EB27D09C36B80
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bankerdiscoverydanabotpersistencespywarestealertrojanadwareransomware

  • Family: Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2