MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 24ff7026fc4c06e06f7188c44a5e2d4429aab0d0de9fcd93d4f8e95210be7ba6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DanaBot


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 24ff7026fc4c06e06f7188c44a5e2d4429aab0d0de9fcd93d4f8e95210be7ba6
SHA3-384 hash: ebab22f143c7c1ada2f157e07764c7d6e00b50374bd08f8c1986b6fc74b1364c467e27a897ab3cd15bc7fc8826c27fda
SHA1 hash: 7616165d2eddc7b6a89fc900ed5dbf5713f87351
MD5 hash: 11ebdce88a124b803dbae051ec56e8d3
humanhash: tennessee-dakota-yankee-two
File name:24ff7026fc4c06e06f7188c44a5e2d4429aab0d0de9fcd93d4f8e95210be7ba6
Download: download sample
Signature DanaBot
Create hunting rule
File size:1'697'296 bytes
First seen:2020-11-08 14:29:00 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 66e2349a49ee9367ea1d2d6063cb910e (3 x DanaBot)
ssdeep 24576:uXuN5U75c3O6rqJ+UWHXbPhUflpiSn/60tzTElyn:e7J+DLPhipiSnNTkO
TLSH 20756D36F240A53FC07B0A3A4567A554943F7771BB19DC0F67E00D88CE7A6816A3A68F
Reporter seifreed
Tags:DanaBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
644
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Graftor-6878643-0
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/24ff7026fc4c06e06f7188c44a5e2d4429aab0d0de9fcd93d4f8e95210be7ba6/
Threat name:
Win32.Trojan.DanaBot
Create hunting rule
Status:
Malicious
First seen:
2020-11-08 14:30:46 UTC
AV detection:
26 of 29 (89.66%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=et7xajx4jqdoa33rrdceuxrniqu2vmgq32p43e6u7duveef6pota._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
persistence
Link:
https://tria.ge/reports/201108-mlp13srey6/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Suspicious use of WriteProcessMemory
Modifies service
Checks BIOS information in registry
Sets DLL path for service in the registry
Sets service image path in registry
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Crypter
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/24ff7026fc4c06e06f7188c44a5e2d4429aab0d0de9fcd93d4f8e95210be7ba6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_danabot_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments