MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 117a69e016f1496265e393f216aea0551d5c14df952c6fc61e8390ab03ded757. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DanaBot


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 117a69e016f1496265e393f216aea0551d5c14df952c6fc61e8390ab03ded757
SHA3-384 hash: 3a71e09381573f1f18c3903140380ca2396cfeb03aa86e6ab79b627f00aa177dcc3ce1ef43d4e43e1af45d727ec1ee22
SHA1 hash: 70bd1d9222b030c220ccc00c969afdeb32d61dba
MD5 hash: 7daa0221894d61fcac662545eaa09629
humanhash: cup-oxygen-nevada-xray
File name:SecuriteInfo.com.W32.AIDetect.malware2.809.3305
Download: download sample
Signature DanaBot
Create hunting rule
File size:1'113'088 bytes
First seen:2021-07-17 12:57:00 UTC
Last seen:2021-07-17 13:33:51 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 169d152bc3371452dbec26f63a5e0c58 (3 x DanaBot, 1 x RedLineStealer)
ssdeep 24576:YXXSiy1vaKFhT+FCtZzomoagvnGhQvPT68B2MEBJ:wSiwaiyFYKmoTnG2PTtB293
Threatray 2'674 similar samples on MalwareBazaar
TLSH T11A35225031B2D437E2AA097108B0C6A5503BFE43ADB2754F7A8B3E0F5A715C6B6E5363
Reporter SecuriteInfoCom
Tags:DanaBot exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
193
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.W32.AIDetect.malware2.809.3305
Verdict:
Malicious activity
Analysis date:
2021-07-17 13:01:33 UTC
Tags:
trojan danabot
Link:
https://app.any.run/tasks/384d7192-d694-4c78-9a23-b46c5753814c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Blackrat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/172336/
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware2.809.3305.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/71ad610e-411c-4f13-b5f5-72844f3cdd1a
Result
Threat name:
Unknown
Detection:
malicious
Classification:
bank.troj.adwa.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/817817
Signature
Bypasses PowerShell execution policy
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Enables a proxy for the internet explorer
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sets a proxy for the internet explorer
Sigma detected: Regsvr32 Anomaly
Sigma detected: Suspicious Script Execution From Temp Folder
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal browser information (history, passwords, etc)
Uses nslookup.exe to query domains
Uses schtasks.exe or at.exe to add and modify task schedules
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 450228 Sample: SecuriteInfo.com.W32.AIDete... Startdate: 17/07/2021 Architecture: WINDOWS Score: 100 54 Multi AV Scanner detection for dropped file 2->54 56 Multi AV Scanner detection for submitted file 2->56 58 Machine Learning detection for sample 2->58 60 2 other signatures 2->60 9 SecuriteInfo.com.W32.AIDetect.malware2.809.exe 1 2->9         started        process3 file4 44 C:\Users\user\Desktop\SECURI~1.EXE.tmp, PE32 9->44 dropped 72 Detected unpacking (changes PE section rights) 9->72 74 Detected unpacking (overwrites its own PE header) 9->74 13 rundll32.exe 2 9->13         started        signatures5 process6 dnsIp7 48 192.119.110.244, 443, 49708, 49727 HOSTWINDSUS United States 13->48 76 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 13->76 78 Bypasses PowerShell execution policy 13->78 80 Uses schtasks.exe or at.exe to add and modify task schedules 13->80 17 rundll32.exe 10 25 13->17         started        signatures8 process9 dnsIp10 46 127.0.0.1 unknown unknown 17->46 42 C:\Users\user\AppData\...\tmpA7D4.tmp.ps1, ASCII 17->42 dropped 62 System process connects to network (likely due to code injection or exploit) 17->62 64 Tries to harvest and steal browser information (history, passwords, etc) 17->64 66 Sets a proxy for the internet explorer 17->66 68 Enables a proxy for the internet explorer 17->68 22 powershell.exe 12 17->22         started        25 powershell.exe 15 17->25         started        27 schtasks.exe 1 17->27         started        29 schtasks.exe 1 17->29         started        file11 signatures12 process13 signatures14 70 Uses nslookup.exe to query domains 22->70 31 nslookup.exe 1 22->31         started        34 conhost.exe 22->34         started        36 conhost.exe 25->36         started        38 conhost.exe 27->38         started        40 conhost.exe 29->40         started        process15 dnsIp16 50 localhost 31->50 52 8.8.8.8.in-addr.arpa 31->52
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/117a69e016f1496265e393f216aea0551d5c14df952c6fc61e8390ab03ded757/
Threat name:
Win32.Trojan.Azorult
Create hunting rule
Status:
Malicious
First seen:
2021-07-17 10:40:44 UTC
AV detection:
19 of 27 (70.37%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
15f9857f558840c792ce0ea7778033570122aceba82dbaf65ee918ecb6cc1daf
DanaBot
1a7f51c4e1cd935526684521fb7890dde315dfd49b4b681044f8b14c6a7c88a0
DanaBot
1f1a3e39c44beff5d0cec8d70471ba7c0976e6e80825fde87bff38d6f7285c6d
DanaBot
26e4bbe3bdc2deb3142b952094d6bd3bb27ee0217d7a9b735a0cc2bbdf6bd9b4
DanaBot
4a79f527d403fdfec5bf88068a5ac86494395d0b735ac27741a4ff78b2434a55
DanaBot
549d8c5e666fe53f6f368df5cd76424bca7ae9f8c07684e2ff19be04fb1815d1
DanaBot
6695e657eb4222667327f2491e831ec37ea3910fb90fc0a1d73e2e272eab95dc
DanaBot
ab7e6dc61621c75a72207bad8a4f3bb1f0a9f1feb515cc1cd3be01009133fc48
DanaBot
bf1d0815cb2eee0abe9e0d8d64c21ebba3e1ebebc5a314c0f225fcfcc5d28889
DanaBot
fdd1a0c90b7b2bbe5ad7e385a2f3242ea42b5e73775f579458368748589ed56c
DanaBot
+ 2'664 additional samples on MalwareBazaar
Result
Malware family:
danabot
Create hunting rule
Score:
  10/10
Tags:
family:danabot botnet:4 banker discovery spyware stealer trojan
Link:
https://tria.ge/reports/210717-924rxfyxmn/
Behaviour
Checks processor information in registry
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Suspicious use of SetThreadContext
Checks installed software on the system
Loads dropped DLL
Reads user/profile data of web browsers
Blocklisted process makes network request
Danabot
Malware Config
C2 Extraction:
192.119.110.244:443
108.170.20.90:443
142.11.206.50:443
Unpacked files
SH256 hash:
e5b167ddb2915ba025b940d4ba8efafedb651bcb7d94e720c60a53344afa234e
MD5 hash:
23408d130fc2b6f239aaf8f2335fd64d
SHA1 hash:
4f6a19f9491b56ba232193e8acab239e6b667db2
Link:
https://www.unpac.me/results/44fb2e1f-d3f1-491a-b8a7-b36b4fec8aa4/
SH256 hash:
e363c71bf1afdabcf365c1145731732de155ab2f398c10cca402387fe69976e7
MD5 hash:
a7edf51616e23210f53c349eee434d4e
SHA1 hash:
62a43b9cab16f8a4ecf6058e5aadbe247e4cd174
Link:
https://www.unpac.me/results/44fb2e1f-d3f1-491a-b8a7-b36b4fec8aa4/
SH256 hash:
117a69e016f1496265e393f216aea0551d5c14df952c6fc61e8390ab03ded757
MD5 hash:
7daa0221894d61fcac662545eaa09629
SHA1 hash:
70bd1d9222b030c220ccc00c969afdeb32d61dba
Link:
https://www.unpac.me/results/44fb2e1f-d3f1-491a-b8a7-b36b4fec8aa4/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/117a69e016f1496265e393f216aea0551d5c14df952c6fc61e8390ab03ded757

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DanaBot

Executable exe 117a69e016f1496265e393f216aea0551d5c14df952c6fc61e8390ab03ded757

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1461110/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/172336/

Comments