MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a5bd1ac8e6458e40e63cf558145dbd06cc2700d97f9ed3ae5a161b165ca6c035. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DanaBot


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a5bd1ac8e6458e40e63cf558145dbd06cc2700d97f9ed3ae5a161b165ca6c035
SHA3-384 hash: 16df9e5bc498cbc333562789f5bf45baaac4f522201b6ccc17295e798509f9e24c8ca79ff5aef756d7817341388fc867
SHA1 hash: 03cdedd359cf66d388f96c6aa48c9ba75469db72
MD5 hash: 87d9f26e60c839281621348244e7a50e
humanhash: oregon-maryland-pennsylvania-foxtrot
File name:SecuriteInfo.com.Variant.Graftor.752710.22488.21345
Download: download sample
Signature DanaBot
Create hunting rule
File size:3'453'952 bytes
First seen:2020-05-19 17:38:21 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash e8aa1309c58f3e5165a7048571442e0f (3 x Gozi, 2 x DanaBot)
ssdeep 98304:nnz8Iqkvs94Kw3xRImj7SLOn6nouQ2Gs8c+j2wzzmghU3S:nzvKw3x0OeG7s87z
Threatray 21 similar samples on MalwareBazaar
TLSH 75F57B017A80E029E9A95AB3CE68D5FD02117D54DF7490DB30D4BF8FBA7BAE69830711
Reporter SecuriteInfoCom
Tags:DanaBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
777
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.PrivateExeProte-11
Create hunting rule

SecuriteInfo.com.Variant.Graftor.752710.22488.21345.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-19 18:35:34 UTC
File Type:
PE (Dll)
Extracted files:
2
AV detection:
20 of 31 (64.52%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
gozi
Create hunting rule
Similar samples:
214e3cd3db2fd521d7a66d0e4ede79c152870ff0330f839d01d7cc141cdc0a14
DanaBot
2a46d6c287851041f7a352051cadd95de3379b8878191c925f7d423a475936e6
DanaBot
32031ca4487b08af41a597da7d22c05a3d4f676c33119c057f3f4a1431217887
DanaBot
4bf2f4dd9ecaa28ecebae186a118cf66f8fce7ee8790351ca7224516ff47010e
DanaBot
504eb3ba676729d316c8f6639ae45b0be030124e0c3007e9edade3b57b49e708
DanaBot
5d65fcb03519e2de623db04685570406c586ee4d121c9381910932cf2e1bd344
DanaBot
7df6cffe72503e47063c3b80da0e2df2d3932fa50cb08daa8f0d0aa8ec7d8184
DanaBot
aa85267b21a04aa673ddde02c00feda1b10782b86eaad3ebbe5617a8ad787774
DanaBot
c58594d414c882ce33499233c2f508789e5fa4d91b79ef01d763012e39d7b095
DanaBot
e1eabf537423c05f282eba3b0c5bc70931767c23fb9bb2a014999a73e7656e4a
DanaBot
+ 11 additional samples on MalwareBazaar
Result
Malware family:
danabot
Create hunting rule
Score:
  10/10
Tags:
family:danabot banker trojan
Link:
https://tria.ge/reports/201109-bza8ep2wd6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Blacklisted process makes network request
ServiceHost packer
Danabot
Malware Config
C2 Extraction:
172.81.129.196
54.38.22.65
192.99.219.207
51.255.134.130
192.236.179.73
23.82.140.201
45.147.228.92
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_danabot_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments