MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 15f6928d92e45e84173ff103c1d5765c4341537e7b91a271078933bf110c7ba4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	15f6928d92e45e84173ff103c1d5765c4341537e7b91a271078933bf110c7ba4
SHA3-384 hash:	6d337c0cb0af51942cc70b3bc4055baa6b630d77674e061965db3f68ab5f1349d1e30a39e741fca0cf4baf4ace27478d
SHA1 hash:	5985cc5fb5f6082455bc3b09f8a91753197aca79
MD5 hash:	8e686830d1d0957d86b68df31360c15c
humanhash:	friend-two-black-saturn
File name:	15f6928d92e45e84173ff103c1d5765c4341537e7b91a271078933bf110c7ba4
Download:	download sample
Signature	DanaBot Alert Create hunting rule
File size:	52'236'288 bytes
First seen:	2024-08-22 00:35:04 UTC
Last seen:	2024-08-22 01:25:09 UTC
File type:	msi
MIME type:	application/x-msi
ssdeep	1572864:Ku46oUt8gGkYTI8SdT7lwi1LE19kjG7NMXQ:E6oUzGkYVSJ7lPo1
TLSH	T19EB73357FC26DA07C1F1663489826BD09F13BC66EA66226B7D68322D0DFF1D60A3504F
TrID	68.9% (.MST) Windows SDK Setup Transform script (61000/1/5) 22.0% (.WPS) Kingsoft WPS Office document (alt.) (19502/3/2) 9.0% (.) Generic OLE2 / Multistream Compound (8000/1)
Reporter	JAMESWT_WT
Tags:	91-92-242-111 DanaBot msi signed

Intelligence

---

File Origin

# of uploads :

3

# of downloads :

92

Origin country :

IT

Vendor Threat Intelligence

CyberFortress Malicious

Verdict:

Malicious

Score:

81.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=66c687f9e7ff3f5a063bb90f

Tags:

Generic Stealth Rugmi

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

fingerprint installer packed

Link:

https://www.filescan.io/uploads/66c687f4131ff69bededa8f4/reports/42c0ebe2-cc08-46af-9bdf-9743ffc06904/overview

Hybrid Analysis TrojanDownloader.Rugmi

Verdict:

Malicious

Labled as:

TrojanDownloader.Rugmi

Link:

https://www.hybrid-analysis.com/sample/15f6928d92e45e84173ff103c1d5765c4341537e7b91a271078933bf110c7ba4

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/15f6928d92e45e84173ff103c1d5765c4341537e7b91a271078933bf110c7ba4

Joe Sandbox DanaBot

Result

Threat name:

DanaBot

Alert

Create hunting rule

Detection:

malicious

Classification:

phis.troj.spyw.evad

Score:

92 / 100

Link:

https://www.joesandbox.com/analysis/1497076

Signature

Adds a directory exclusion to Windows Defender

AI detected suspicious sample

Contains functionality to infect the boot sector

May use the Tor software to hide its network traffic

Multi AV Scanner detection for submitted file

PE file has a writeable .text section

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Instant Messenger accounts or passwords

Yara detected DanaBot stealer dll

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

ARCHIVE

Link:

https://malprob.io/report/15f6928d92e45e84173ff103c1d5765c4341537e7b91a271078933bf110c7ba4

CERT.PL MWDB

Gathering data

ReversingLabs TitaniumCloud Win32.Trojan.Malgent

Threat name:

Win32.Trojan.Malgent

Alert

Create hunting rule

Status:

Malicious

First seen:

2024-08-14 14:02:02 UTC

File Type:

Binary (Archive)

Extracted files:

2971

AV detection:

10 of 38 (26.32%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=cx3jfdms4rpiifz76eb4dvlwlrbucu36poi2e4ihrez36eimposa._file

Threatray unknown

Verdict:

unknown

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  6/10

Tags:

discovery evasion persistence privilege_escalation trojan

Link:

https://tria.ge/reports/240822-axxdbssgpn/

Behaviour

Checks SCSI registry key(s)

Modifies data under HKEY_USERS

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Volume Shadow Copy service COM API

Enumerates physical storage devices

Event Triggered Execution: Installer Packages

Program crash

System Location Discovery: System Language Discovery

Drops file in Windows directory

Executes dropped EXE

Loads dropped DLL

Blocklisted process makes network request

Checks whether UAC is enabled

Enumerates connected drives

Threat.Zone Suspicious

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/5b5c50a2-b85f-41f7-b9f5-7ba904a095f9

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.