MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 1ca80a11ef3697eb8e029d00ade8fcfcd6562d64ca703c619c0880cccd5eab2e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
DanaBot
Vendor detections: 13
| SHA256 hash: | 1ca80a11ef3697eb8e029d00ade8fcfcd6562d64ca703c619c0880cccd5eab2e |
|---|---|
| SHA3-384 hash: | d8762c0463d5e53701a136fedb9f3087b3089f984771def68c8c23b17d27585e0a9d83a918cb464cb782812d76ac2f96 |
| SHA1 hash: | 45a48252d13a8edaf6ed4ee04ce2585c4b264618 |
| MD5 hash: | 4ee04b45353d44134a92d25d9bc583b0 |
| humanhash: | artist-glucose-cup-solar |
| File name: | SecuriteInfo.com.W32.AIDetect.malware1.27695.16023 |
| Download: | download sample |
| Signature | DanaBot |
| File size: | 1'728'512 bytes |
| First seen: | 2021-12-21 22:19:03 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 50260a050601790c4e5b52ad3a365640 (1 x DanaBot) |
| ssdeep | 49152:DsASPzj3kNembqQsvcT+eyU+Cnt0f1UKB:4bkhgU+CnGf1UO |
| Threatray | 370 similar samples on MalwareBazaar |
| TLSH | T1538533C42ED2DDA2CAD74D73D6669D952B3C780289B5506FB3A43A6F2F600C0887E371 |
| File icon (PE): |  |
| dhash icon | 480c1c4c4f594b14 (173 x Smoke Loader, 134 x RedLineStealer, 98 x Amadey) |
| Reporter |  SecuriteInfoCom |
| Tags: | DanaBot exe |
Intelligence
File Origin
# of uploads :
1
# of downloads :
521
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.W32.AIDetect.malware1.27695.16023
Verdict:
Malicious activity
Analysis date:
2021-12-21 22:20:39 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
DanaBot
Result
Verdict:
Suspicious
Maliciousness:
Behaviour
Creating a file
Enabling the 'hidden' option for recently created files
DNS request
Launching a process
Creating a process with a hidden window
Result
Malware family:
n/a
Score:
9/10
Tags:
n/a
Behaviour
MalwareBazaar
CPUID_Instruction
MeasuringTime
SystemUptime
EvasionGetTickCount
CheckCmdLine
EvasionQueryPerformanceCounter
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
greyware packed
Malware family:
Generic Malware
Verdict:
Malicious
Result
Threat name:
DanaBot
Detection:
malicious
Classification:
troj.evad
Score:
96 / 100
Signature
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Yara detected DanaBot stealer dll
Behaviour
Behavior Graph:
Threat name:
Win32.Packed.Generic
Status:
Suspicious
First seen:
2021-12-21 19:59:45 UTC
File Type:
PE (Exe)
Extracted files:
15
AV detection:
18 of 28 (64.29%)
Threat level:
1/5
Detection(s):
Malicious file
Verdict:
malicious
Similar samples:
+ 360 additional samples on MalwareBazaar
Result
Malware family:
danabot
Score:
10/10
Tags:
family:danabot botnet:4 banker trojan
Behaviour
Suspicious use of WriteProcessMemory
Loads dropped DLL
Danabot
Danabot Loader Component
Malware Config
C2 Extraction:
142.11.244.223:443
23.106.122.139:443
23.106.122.139:443
Unpacked files
SH256 hash:
409fef89a90ac7970af9503fdb6b5ae72e4d52c01575b0a96a3ee099ee4a0b07
MD5 hash:
20149208c91292579ffd5c076c879a58
SHA1 hash:
3d8c5c9ff461095f9cb284faed318278eae7bccc
SH256 hash:
f16c0582b70a9c498efccfa4da61b9af26b8b8060019a1974fde54769ff97df6
MD5 hash:
12383d0c62f500a3cd2475a6acc80137
SHA1 hash:
0d5104f324e16a1bced200f8ef1d8093c63fef49
SH256 hash:
1ca80a11ef3697eb8e029d00ade8fcfcd6562d64ca703c619c0880cccd5eab2e
MD5 hash:
4ee04b45353d44134a92d25d9bc583b0
SHA1 hash:
45a48252d13a8edaf6ed4ee04ce2585c4b264618
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.