MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0e944b8d267b5953db344e86f0071fb5f672fdeb8e2df8aa841f975f2e448d75. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DanaBot


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0e944b8d267b5953db344e86f0071fb5f672fdeb8e2df8aa841f975f2e448d75
SHA3-384 hash: e177abdb72bc3a1f147642c5eb43ce3cd444da9affcc11edf87b789e6b1fdedf72ad4208d869233fe4eee25c44d56326
SHA1 hash: a2681565044b5d0196ac490b7d26ff050a9c4f9a
MD5 hash: 4942416a4cbb46532c1296d93ba1627c
humanhash: asparagus-lion-india-september
File name:4942416a4cbb46532c1296d93ba1627c
Download: download sample
Signature DanaBot
Create hunting rule
File size:1'118'208 bytes
First seen:2021-07-18 15:24:44 UTC
Last seen:2021-07-18 15:45:23 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash b0fe27671bb60a5d31189716fdcf7690 (3 x Smoke Loader, 1 x RaccoonStealer, 1 x Stop)
ssdeep 24576:hfmRv8oVfvvPEQ85Wi9oSy8GbShVeZOzeBHhIFwJMNvmRU7xvi26y0v:a9nvsQ6BaSyNSOZ5BH6Fw+vmRU7x63v
Threatray 2'689 similar samples on MalwareBazaar
TLSH T17B352310BB95ED71F1954A3418EAC6B52E3F7E436E38550F36843AFEADB05C250AC34A
Reporter zbetcheckin
Tags:32 DanaBot exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
187
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
4942416a4cbb46532c1296d93ba1627c
Verdict:
Malicious activity
Analysis date:
2021-07-18 15:28:34 UTC
Tags:
trojan danabot stealer
Link:
https://app.any.run/tasks/cdbe9514-f18b-450c-86dd-d1b7f2c68a4f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/172418/
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware2.8893.20376.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/00a62f48-49e5-4604-92ca-4312a45c1231
Result
Threat name:
Unknown
Detection:
malicious
Classification:
bank.troj.adwa.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/817935
Signature
Bypasses PowerShell execution policy
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Enables a proxy for the internet explorer
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sets a proxy for the internet explorer
Sigma detected: Suspicious Script Execution From Temp Folder
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal browser information (history, passwords, etc)
Uses nslookup.exe to query domains
Uses schtasks.exe or at.exe to add and modify task schedules
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 450346 Sample: dGzO0OsUti Startdate: 18/07/2021 Architecture: WINDOWS Score: 100 54 Multi AV Scanner detection for dropped file 2->54 56 Multi AV Scanner detection for submitted file 2->56 58 Machine Learning detection for sample 2->58 60 Sigma detected: Suspicious Script Execution From Temp Folder 2->60 9 dGzO0OsUti.exe 1 2->9         started        process3 file4 44 C:\Users\user\Desktop\DGZO0O~1.EXE.tmp, PE32 9->44 dropped 72 Detected unpacking (changes PE section rights) 9->72 74 Detected unpacking (overwrites its own PE header) 9->74 13 rundll32.exe 2 9->13         started        signatures5 process6 dnsIp7 48 142.11.244.124, 443, 49715, 49731 HOSTWINDSUS United States 13->48 76 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 13->76 78 Bypasses PowerShell execution policy 13->78 80 Uses schtasks.exe or at.exe to add and modify task schedules 13->80 17 rundll32.exe 10 24 13->17         started        signatures8 process9 dnsIp10 46 127.0.0.1 unknown unknown 17->46 42 C:\Users\user\AppData\...\tmp8555.tmp.ps1, ASCII 17->42 dropped 62 System process connects to network (likely due to code injection or exploit) 17->62 64 Tries to harvest and steal browser information (history, passwords, etc) 17->64 66 Sets a proxy for the internet explorer 17->66 68 Enables a proxy for the internet explorer 17->68 22 powershell.exe 12 17->22         started        25 powershell.exe 15 17->25         started        27 schtasks.exe 1 17->27         started        29 schtasks.exe 1 17->29         started        file11 signatures12 process13 signatures14 70 Uses nslookup.exe to query domains 22->70 31 nslookup.exe 1 22->31         started        34 conhost.exe 22->34         started        36 conhost.exe 25->36         started        38 conhost.exe 27->38         started        40 conhost.exe 29->40         started        process15 dnsIp16 50 localhost 31->50 52 8.8.8.8.in-addr.arpa 31->52
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0e944b8d267b5953db344e86f0071fb5f672fdeb8e2df8aa841f975f2e448d75/
Threat name:
Win32.Ransomware.StopCrypt
Create hunting rule
Status:
Malicious
First seen:
2021-07-18 15:25:03 UTC
AV detection:
15 of 28 (53.57%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
117a69e016f1496265e393f216aea0551d5c14df952c6fc61e8390ab03ded757
DanaBot
15f9857f558840c792ce0ea7778033570122aceba82dbaf65ee918ecb6cc1daf
DanaBot
1a7f51c4e1cd935526684521fb7890dde315dfd49b4b681044f8b14c6a7c88a0
DanaBot
1f1a3e39c44beff5d0cec8d70471ba7c0976e6e80825fde87bff38d6f7285c6d
DanaBot
549d8c5e666fe53f6f368df5cd76424bca7ae9f8c07684e2ff19be04fb1815d1
DanaBot
6695e657eb4222667327f2491e831ec37ea3910fb90fc0a1d73e2e272eab95dc
DanaBot
ab7e6dc61621c75a72207bad8a4f3bb1f0a9f1feb515cc1cd3be01009133fc48
DanaBot
bf1d0815cb2eee0abe9e0d8d64c21ebba3e1ebebc5a314c0f225fcfcc5d28889
DanaBot
d24b2f6e96fa1b2bb20b19e3b70757887a3f4934d035fde4efdbdd5b9e845df9
DanaBot
fdd1a0c90b7b2bbe5ad7e385a2f3242ea42b5e73775f579458368748589ed56c
DanaBot
+ 2'679 additional samples on MalwareBazaar
Result
Malware family:
danabot
Create hunting rule
Score:
  10/10
Tags:
family:danabot botnet:4 banker discovery spyware stealer trojan
Link:
https://tria.ge/reports/210718-cmr94ghdxe/
Behaviour
Checks processor information in registry
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Suspicious use of SetThreadContext
Checks installed software on the system
Loads dropped DLL
Reads user/profile data of web browsers
Blocklisted process makes network request
Danabot
Malware Config
C2 Extraction:
142.11.244.124:443
142.11.206.50:443
Gathering data
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0e944b8d267b5953db344e86f0071fb5f672fdeb8e2df8aa841f975f2e448d75

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DanaBot

Executable exe 0e944b8d267b5953db344e86f0071fb5f672fdeb8e2df8aa841f975f2e448d75

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/172418/
  
URLhaus
https://urlhaus.abuse.ch/url/1461110/
  
URLhaus
https://urlhaus.abuse.ch/url/1464004/

Comments


Avatar
zbet commented on 2021-07-18 15:24:45 UTC

url : hxxp://108.170.20.90/cvhost.exe