MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1b66defbea4f416df3e25f4289193c9eb5e5fb8f57c3a0c679980b9bb4605dcc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DanaBot


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1b66defbea4f416df3e25f4289193c9eb5e5fb8f57c3a0c679980b9bb4605dcc
SHA3-384 hash: 51b4a600870bc4e1d9cd16c22da7a62ee590493a08e90ea34ff631e2fd28abcba550e9303a68328e2b810121cb80c4ca
SHA1 hash: 41d1dba0618e06bcf84ef9b75b9c6a0fc465cd6a
MD5 hash: d187b3090459a7b56d8c8d3f34ceed5c
humanhash: speaker-emma-summer-don
File name:d187b3090459a7b56d8c8d3f34ceed5c.exe
Download: download sample
Signature DanaBot
Create hunting rule
File size:1'836'032 bytes
First seen:2021-11-18 19:58:02 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 9abf03d4e22c0a12cb29c8d67fb192e4 (3 x Smoke Loader, 2 x RaccoonStealer, 1 x DanaBot)
ssdeep 24576:/uvVuc0qqCJwy/3EL+8Kwz1X04LiyrjXkIqN0YId3X66gzrMF9EnbvLEgShjT0xt:/uvVuKwbq7wBX0ujXkF+gzr9nbvL0T3
Threatray 7'322 similar samples on MalwareBazaar
TLSH T1A3852304B7A1C03AF1F245F85DB68368BA3E39E1637995CB11D206EE89256D4ECB2707
File icon (PE):PE icon
dhash icon badacaaecee6baa2 (3 x RedLineStealer, 2 x RaccoonStealer, 2 x Smoke Loader)
Reporter abuse_ch
Tags:DanaBot exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
453
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
d187b3090459a7b56d8c8d3f34ceed5c.exe
Verdict:
Malicious activity
Analysis date:
2021-11-18 20:05:33 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/eacc9779-24ff-4b0e-95ac-cd36f27d01df

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
DanaBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/207386/
Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Creating a file
Enabling the 'hidden' option for recently created files
DNS request
Sending a custom TCP request
Launching a process
Creating a process with a hidden window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/6196b0502695a62af9f343cf/reports/3368a02a-5b0b-4184-b564-43f39919f969/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/28e392af-0518-456f-99b8-8105e67b428c
Result
Threat name:
DanaBot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/892263
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Yara detected DanaBot stealer dll
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1b66defbea4f416df3e25f4289193c9eb5e5fb8f57c3a0c679980b9bb4605dcc/
Threat name:
Win32.Trojan.Strab
Create hunting rule
Status:
Malicious
First seen:
2021-11-18 19:59:06 UTC
AV detection:
21 of 28 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dntn567kj5aw347cl5bisgj4t226l64pk7b2brtztafzxndalxga._file
Verdict:
malicious
Similar samples:
36499f5c573a8752c3b566b19e52f3a235e73e4cdb7123f3452a007c945f7daf
DanaBot
4c10e02c77070c0558030d3e6ae93d73fb02ef21665eab6359f8a1b17fde0b9a
DanaBot
4f4a33f70099855f5f503716515f388da3a5daa1e2fac59ec6c881e89ef7d072
DanaBot
5d7bc178cb3eafae7b2c99b2cfd2ceec87119cf2403f86af87435d4479f36724
DanaBot
7ec78d6c2c919a22185cb0000f2e273d66019b8409a3ca47c819d44cedead22e
DanaBot
86b93054415c6e4c21fd68ad13fcdbbd9a300c275dfe4f768ffd2fdf42db4694
DanaBot
8dec5ed95d3ca077bb1c2695074877a7160f97960df22a119d9f2debfb18dc0b
DanaBot
9381faa9dcbde308f4ce87d5dfc36b6a5e8e2a263057ecb2d8f8840061ac2a58
DanaBot
c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43
DanaBot
e4938a8244543631ae11deb46e8b4cc3f0a8b8b7c2d4a1246f5bfadb29e0094c
DanaBot
+ 7'312 additional samples on MalwareBazaar
Result
Malware family:
danabot
Create hunting rule
Score:
  10/10
Tags:
family:danabot banker trojan
Link:
https://tria.ge/reports/211118-yptt8sadg2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Loads dropped DLL
Danabot
Danabot Loader Component
Suspicious use of NtCreateProcessExOtherParentProcess
Malware Config
C2 Extraction:
192.119.110.73:443
192.236.192.201:443
Unpacked files
SH256 hash:
d92bffb7e824f088219ae6e3467b6bb7602144dd9449018a4d15adffbd47df48
MD5 hash:
3c8ccecf838036d5207534ed0d7b766a
SHA1 hash:
3f77ae96761b9f8a3d130729ad523a385e5b8440
Link:
https://www.unpac.me/results/cc04df0c-5447-439f-9fe9-ca1e0853a758/
SH256 hash:
c0f1b64e7be951a7fb0953441ae53703d57de5673f610ecb7b507193cddaf5c1
MD5 hash:
481017cbff2b4d7f53d8fb1d49eef909
SHA1 hash:
1417557a49431d925ea3411bca325b4abcb5d109
Link:
https://www.unpac.me/results/cc04df0c-5447-439f-9fe9-ca1e0853a758/
SH256 hash:
1b66defbea4f416df3e25f4289193c9eb5e5fb8f57c3a0c679980b9bb4605dcc
MD5 hash:
d187b3090459a7b56d8c8d3f34ceed5c
SHA1 hash:
41d1dba0618e06bcf84ef9b75b9c6a0fc465cd6a
Link:
https://www.unpac.me/results/cc04df0c-5447-439f-9fe9-ca1e0853a758/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1b66defbea4f416df3e25f4289193c9eb5e5fb8f57c3a0c679980b9bb4605dcc

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DanaBot

Executable exe 1b66defbea4f416df3e25f4289193c9eb5e5fb8f57c3a0c679980b9bb4605dcc

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1772785/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/207386/

Comments