MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 14d1b1a276cc2ca724d2ad6eeb0d9090c456a3aa11ac80f977911496b3123a91. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

DanaBot

Vendor detections: 4

Intelligence 4 IOCs YARA File information Comments 1

SHA256 hash:	14d1b1a276cc2ca724d2ad6eeb0d9090c456a3aa11ac80f977911496b3123a91
SHA3-384 hash:	f35a7dec466d9353b939bd1e268191897ec3e581a805bea6186674e6d5a374198cf51aa4217e19b713ba77debccab66b
SHA1 hash:	f5b01b158aabbb104e53e6f4dc76a77b6a928848
MD5 hash:	875071870de4fad3639b04a6b7f3f3fb
humanhash:	uniform-stairway-hotel-jupiter
File name:	SecuriteInfo.com.Trojan.Siggen9.32682.17451.1260
Download:	download sample
Signature	DanaBot Create hunting rule
File size:	1'132'544 bytes
First seen:	2020-04-03 12:33:51 UTC
Last seen:	2020-04-04 07:34:22 UTC
File type:	dll
MIME type:	application/x-dosexec
imphash	fe26e7b16e3f193a2724b0f29af64aaa (1 x DanaBot)
ssdeep	12288:ARujDnxc+np/5vP4AYiXm53JzVRt+Y0H7v3K58zMQmrxEAjMLe:ARu/nqWptP4AYiMMY0H7vK58Rm9EAYS
Threatray	291 similar samples on MalwareBazaar
TLSH	3F357D32F585A93EC19F16391933AB54853F7B226D278C5F67F24848CE29881297F24F
Reporter	SecuriteInfoCom
Tags:	DanaBot

Intelligence

File Origin

# of uploads :

# of downloads :

731

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Trojan.Siggen9.32682.17451.1260.UNOFFICIAL

PUA.Win.Adware.Graftor-6878643-0

Gathering data

Threat name:

Win32.Trojan.Danabot

Status:

Malicious

First seen:

2020-04-03 04:43:00 UTC

File Type:

PE (Dll)

AV detection:

27 of 31 (87.10%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=cti3ditwzqwkojgsvvxowdmqsdcfni5kcgwib6lxsekjnmyshkiq._file

Verdict:

malicious

Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

DanaBot

xls 91c05e799c079448d87b45dcb83472ba1009513290157e39fa62fcae06436157

DanaBot

DLL dll 14d1b1a276cc2ca724d2ad6eeb0d9090c456a3aa11ac80f977911496b3123a91

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/334269/

URLhaus

https://urlhaus.abuse.ch/url/334274/

URLhaus

https://urlhaus.abuse.ch/url/334732/

Dropped by

SHA256 91c05e799c079448d87b45dcb83472ba1009513290157e39fa62fcae06436157

Dropped by

MD5 51afe266b0d9ac8e9947928591c0494e

Delivery method

Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
AUTH_API	Manipulates User Authorization	advapi32.dll::CreateWellKnownSid advapi32.dll::FreeSid advapi32.dll::InitializeSecurityDescriptor
COM_BASE_API	Can Download & Execute components	ole32.dll::CoCreateInstance
SECURITY_BASE_API	Uses Security Base API	advapi32.dll::GetTokenInformation advapi32.dll::SetSecurityDescriptorDacl
WIN32_PROCESS_API	Can Create Process and Threads	advapi32.dll::OpenProcessToken kernel32.dll::OpenProcess advapi32.dll::OpenThreadToken kernel32.dll::WriteProcessMemory kernel32.dll::CloseHandle kernel32.dll::CreateThread
WIN_BASE_API	Uses Win Base API	kernel32.dll::LoadLibraryExW kernel32.dll::LoadLibraryA kernel32.dll::LoadLibraryW kernel32.dll::GetVolumeInformationW kernel32.dll::GetSystemInfo kernel32.dll::GetStartupInfoW
WIN_BASE_IO_API	Can Create Files	kernel32.dll::CreateDirectoryW kernel32.dll::CreateFileW kernel32.dll::DeleteFileW kernel32.dll::GetFileAttributesW kernel32.dll::FindFirstFileW version.dll::GetFileVersionInfoSizeW
WIN_CRYPT_API	Uses Windows Crypt API	advapi32.dll::CryptHashData
WIN_REG_API	Can Manipulate Windows Registry	advapi32.dll::RegOpenKeyExW advapi32.dll::RegQueryValueExW
WIN_USER_API	Performs GUI Actions	user32.dll::FindWindowA user32.dll::PeekMessageW user32.dll::CreateWindowExW

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

commented on 2020-04-04 07:34:30 UTC

DanaBot malspam:

HELO: imsa.trendmicro.com
Sending IP: 59.41.8.249
Subject: invoice 00/56/9247
Attachment: invoice_220.xls

DanaBot payload URL:
https://hillsbed.xyz/BAYgODA0NUQ2OEY1RTA2ODg4RDhCQzlEQzRBRUU3QTA5OUI=

DanaBot C2s:
185.181.8.49:443
64.188.19.39:443
185.136.167.142:443
151.106.53.109:443
172.245.247.101:443
64.188.12.140:443