MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 152265b11b39688bfa5dd656dddacf87c01515f70f62aeb3b1406138a77986d5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DanaBot


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 152265b11b39688bfa5dd656dddacf87c01515f70f62aeb3b1406138a77986d5
SHA3-384 hash: af9a42af9696ead3c27a560ba0c7d86125b580082ff54774cfb17ee9eb2f53c0f0f8756568e2bb9bcd181896b25c6def
SHA1 hash: 11f350112bdd668b11b2fb3849ef2b0c7c020bb4
MD5 hash: 1c52aed4df30df05a45966183eeef3c2
humanhash: carpet-item-five-charlie
File name:eufive_20210725-084051
Download: download sample
Signature DanaBot
Create hunting rule
File size:1'034'752 bytes
First seen:2021-07-25 08:35:36 UTC
Last seen:2021-07-25 09:54:10 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 22db311026ae931b05f66671eeb9d534 (1 x DanaBot)
ssdeep 24576:Tq/spU59DWkSn/enEYnXnEdI8UkY621c+9ytgYrToZmYyWa8CX:TqN9ahn/0EYnKI84621fq/AcYHg
Threatray 2'951 similar samples on MalwareBazaar
TLSH T1EE25123262C14D3AD0953A3D08C2BF46982E79309E6F9CE31DEF495BCC1A791643669F
Reporter benkow_
Tags:DanaBot exe


Avatar
benkow_
Dropped by GCleaner in Europe the 25th of July 2021
c2:
192.52.166.169:443
173.254.204.95:443
192.52.167.45:443

v1987
Botnet 15

Intelligence

File Origin
# of uploads :
2
# of downloads :
202
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
eufive_20210725-084051
Verdict:
Malicious activity
Analysis date:
2021-07-25 08:36:21 UTC
Tags:
trojan danabot
Link:
https://app.any.run/tasks/c8ba18bb-f82d-410f-8da5-c934532f188f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Blackrat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/173995/
Detection(s):
PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Creating a file
Enabling the 'hidden' option for recently created files
Launching a process
Creating a process with a hidden window
Sending a UDP request
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/ab1d6eb3-9f41-4f55-b96a-6ccd86280dd9
Result
Threat name:
Unknown
Detection:
malicious
Classification:
bank.troj.adwa.spyw.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/821445
Signature
Bypasses PowerShell execution policy
Enables a proxy for the internet explorer
Machine Learning detection for sample
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sets a proxy for the internet explorer
Sigma detected: Suspicious Script Execution From Temp Folder
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal browser information (history, passwords, etc)
Uses nslookup.exe to query domains
Uses schtasks.exe or at.exe to add and modify task schedules
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 453855 Sample: eufive_20210725-084051 Startdate: 25/07/2021 Architecture: WINDOWS Score: 84 57 Machine Learning detection for sample 2->57 59 Sigma detected: Suspicious Script Execution From Temp Folder 2->59 9 eufive_20210725-084051.exe 1 2->9         started        process3 file4 43 C:\Users\user\DesktopUFIVE~1.EXE.tmp, PE32 9->43 dropped 12 rundll32.exe 2 9->12         started        process5 dnsIp6 51 192.52.166.169, 443, 49711, 49727 ASN-QUADRANET-GLOBALUS United States 12->51 71 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 12->71 73 Bypasses PowerShell execution policy 12->73 75 Uses schtasks.exe or at.exe to add and modify task schedules 12->75 16 rundll32.exe 10 25 12->16         started        signatures7 process8 dnsIp9 45 45.155.205.150, 44555 SCALAXY-ASNL Russian Federation 16->45 47 173.254.204.95, 443, 49728 ASN-QUADRANET-GLOBALUS United States 16->47 49 127.0.0.1 unknown unknown 16->49 41 C:\Users\user\AppData\...\tmp8016.tmp.ps1, ASCII 16->41 dropped 61 System process connects to network (likely due to code injection or exploit) 16->61 63 Tries to harvest and steal browser information (history, passwords, etc) 16->63 65 Sets a proxy for the internet explorer 16->65 67 Enables a proxy for the internet explorer 16->67 21 powershell.exe 14 16->21         started        24 powershell.exe 17 16->24         started        26 schtasks.exe 1 16->26         started        28 schtasks.exe 1 16->28         started        file10 signatures11 process12 signatures13 69 Uses nslookup.exe to query domains 21->69 30 nslookup.exe 1 21->30         started        33 conhost.exe 21->33         started        35 conhost.exe 24->35         started        37 conhost.exe 26->37         started        39 conhost.exe 28->39         started        process14 dnsIp15 53 localhost 30->53 55 8.8.8.8.in-addr.arpa 30->55
Gathering data
Verdict:
malicious
Similar samples:
0e944b8d267b5953db344e86f0071fb5f672fdeb8e2df8aa841f975f2e448d75
DanaBot
117a69e016f1496265e393f216aea0551d5c14df952c6fc61e8390ab03ded757
DanaBot
15f9857f558840c792ce0ea7778033570122aceba82dbaf65ee918ecb6cc1daf
DanaBot
1862c6b58deef050db0cb8f2fe013c3e49002469d234b5c9857f2d6c5114e32d
DanaBot
3c62996e0dc98bf3e9ebbdcf8c89f47429fa7a0285ddcd665923b70b06d4586a
DanaBot
6c2d454f29053786199a28e03981f69389d7251e11ad36f33604dc5a4d7ea306
DanaBot
c5865c574aedb211df90e15ff196a7cbedfa537389823262c941842bf04c91a0
DanaBot
c76a9b5f3a1d4456cf2fe90c115f808e4a53f04a5520eabd945af7d41c44b986
DanaBot
ef6fc7bf417d763f9c7c8c9bf723ce7d3b4acbeb4cc47e65bcb3d6b8f143fee2
DanaBot
fdd1a0c90b7b2bbe5ad7e385a2f3242ea42b5e73775f579458368748589ed56c
DanaBot
+ 2'941 additional samples on MalwareBazaar
Result
Malware family:
danabot
Create hunting rule
Score:
  10/10
Tags:
family:danabot botnet:15 banker discovery spyware stealer trojan
Link:
https://tria.ge/reports/210725-vdlm7pqxza/
Behaviour
Checks processor information in registry
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Suspicious use of SetThreadContext
Checks installed software on the system
Loads dropped DLL
Reads user/profile data of web browsers
Blocklisted process makes network request
Danabot
Malware Config
C2 Extraction:
192.52.166.169:443
173.254.204.95:443
192.52.167.45:443
Unpacked files
SH256 hash:
0abf70595efc6d1013e0edc1cc6208df3291db180a41814b367bda9b2f741441
MD5 hash:
c6a1acce3f89edea61b44ecf55dbc003
SHA1 hash:
c5f07041f44922269d6b343f67683d9d343bda46
Link:
https://www.unpac.me/results/b7b3111a-5637-42f4-90e6-54445777d611/
SH256 hash:
152265b11b39688bfa5dd656dddacf87c01515f70f62aeb3b1406138a77986d5
MD5 hash:
1c52aed4df30df05a45966183eeef3c2
SHA1 hash:
11f350112bdd668b11b2fb3849ef2b0c7c020bb4
Link:
https://www.unpac.me/results/b7b3111a-5637-42f4-90e6-54445777d611/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/152265b11b39688bfa5dd656dddacf87c01515f70f62aeb3b1406138a77986d5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malpedia
Malpedia
https://malpedia.caad.fkie.fraunhofer.de/details/win.danabot
  
Dropped by
GCleaner
  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/173995/

Comments