MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 045d257fff1a2678715e67b6ce278456bd264514598fd51a3fc8023d58f64c3a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DanaBot


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 045d257fff1a2678715e67b6ce278456bd264514598fd51a3fc8023d58f64c3a
SHA3-384 hash: 9720920ae684dc62ac460560292bfa7098dc5cbc16a668319de59c96c6285d519b3013bce792c36286d8eaa954d0f8b7
SHA1 hash: c1a3ad417de6d479702697a6a481b23240fe0e09
MD5 hash: 065605a957e201919c4627b7c8a97e46
humanhash: red-sierra-stairway-bacon
File name:065605a957e201919c4627b7c8a97e46.exe
Download: download sample
Signature DanaBot
Create hunting rule
File size:3'835'392 bytes
First seen:2023-01-06 09:40:29 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 71a7b8362d37c5264550467f8b3e52de (6 x RedLineStealer, 2 x Smoke Loader, 2 x Stop)
ssdeep 98304:/HtvWtYBbH/zJLqR0FU8UTi74npUUiX0wY0JXu:VOt4b9/UC7K60d0JX
Threatray 17'379 similar samples on MalwareBazaar
TLSH T1E00633906999D832C4436E329B6B9E8D8EB72C66D96481CF7739F21EDFB81C15230347
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 1024e398cce72158 (3 x RedLineStealer, 2 x DanaBot, 1 x Smoke Loader)
Reporter abuse_ch
Tags:DanaBot exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
211
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
065605a957e201919c4627b7c8a97e46.exe
Verdict:
Malicious activity
Analysis date:
2023-01-06 09:41:34 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/d2a89077-34a7-48ab-883c-23d3b212f8f6

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/349919/
Detection(s):
SecuriteInfo.com.MSIL-28.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a window
Searching for synchronization primitives
Launching a process
Creating a process with a hidden window
Launching the default Windows debugger (dwwin.exe)
Verdict:
No Threat
Threat level:
  2/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/63b7ecafa70bef46551d509e/reports/50ffb8cb-e5f6-49f6-baea-b7cf31533fbc/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
DanaBot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/23bcdea7-79a9-4050-b5bf-b9d35698f5ee
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/1146394
Signature
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/045d257fff1a2678715e67b6ce278456bd264514598fd51a3fc8023d58f64c3a/
Threat name:
Win32.Trojan.SmokeLoader
Create hunting rule
Status:
Malicious
First seen:
2023-01-06 09:41:09 UTC
File Type:
PE (Exe)
Extracted files:
32
AV detection:
27 of 41 (65.85%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=arosk777dithq4k6m63m4j4ek26smriulgh5kgr7zabd2whwjq5a._file
Verdict:
malicious
Similar samples:
2ee350a3c3c03283a1458ff5e3e142d91b46a8fecd846ec8df0d1edca7c1e4cf
DanaBot
4ba96ecdcdfa746de28a0ee3ef474842e829917c9486ace35ec4cc2fa1ad956f
DanaBot
5aa3feae8dfef7ef4aafe4526474b7ddbd325b6f32d02c68fb8a2d441730fab2
DanaBot
728de9789af5f2ebc9ac2fac80fee25b186bc5b3acb960650934377f0c77726d
DanaBot
81dda2ffa7d1039d3b745540573c6e8c728584d536a449f5baa031fb40fc065d
DanaBot
991784842d251cd682b56f4639e49ffd77bd1fa272caa8734a6ae78647daa761
DanaBot
c1caac58e614931c517666747eec84548ca762fff9744c47ed6cfe162c511331
DanaBot
c44b3b7ff81213a270ea2e6e76105211c9c4a9a8eb0f612031fbfcb1f0e03f91
DanaBot
fb969368089041dd5ac9bbd7966e27db66490e697c0f5674aa8bc7fef5a4efee
DanaBot
fbd172f7f6c9e4b8c915d7ff24d40ddcad456223407e383b2230f24e046031bb
DanaBot
+ 17'369 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/230106-lnrl9sfe94/
Behaviour
Checks processor information in registry
Modifies registry class
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of SetThreadContext
Loads dropped DLL
Blocklisted process makes network request
Verdict:
Informative
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/b4d43a57-f3c5-4a50-8e10-c7a85b2a885b
Unpacked files
SH256 hash:
35c37a51190bf7ea125004b3e02cb32ee38995fa6023531d4c5d6805a95d4b1f
MD5 hash:
ccb9fda0d5198aae0bc29a10feff5073
SHA1 hash:
054acf127802782ab9c88cb05141c51b5e43c51f
Link:
https://www.unpac.me/results/3237fd28-560d-49b6-a741-a8bc4db07ff8/
SH256 hash:
d286d1b653e70aefe17fe4dee3378484266e02d6c7a33f05f8adb4e309276f19
MD5 hash:
68e761914a85ca9cf0d10360c878878a
SHA1 hash:
c31463a5a91636823cc96eebf6a128b356d9b615
Link:
https://www.unpac.me/results/3237fd28-560d-49b6-a741-a8bc4db07ff8/
SH256 hash:
045d257fff1a2678715e67b6ce278456bd264514598fd51a3fc8023d58f64c3a
MD5 hash:
065605a957e201919c4627b7c8a97e46
SHA1 hash:
c1a3ad417de6d479702697a6a481b23240fe0e09
Link:
https://www.unpac.me/results/3237fd28-560d-49b6-a741-a8bc4db07ff8/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/045d257fff1a/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/045d257fff1a2678715e67b6ce278456bd264514598fd51a3fc8023d58f64c3a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:Windows_Trojan_Smokeloader_3687686f
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/349919/

Comments