🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2e867f5354044d36e1fc8f47f917c7cc8ffcf00067fa313d907a67124816c9fc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DanaBot


Vendor detections: 11


Intelligence 11 IOCs YARA 25 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2e867f5354044d36e1fc8f47f917c7cc8ffcf00067fa313d907a67124816c9fc
SHA3-384 hash: 494e0f46baaa1d1883696b1930373d08ff2757087747e06837fd25ea5a0c64b1cb1a6809227f7066889c2e0ada287568
SHA1 hash: 97cb1d48e22505634d2b7dcdf24c0f1ef04730f1
MD5 hash: 119489552f8016fb96afaa3ae1b86ac3
humanhash: pip-december-batman-white
File name:119489552F8016FB96AFAA3AE1B86AC3.dll
Download: download sample
Signature DanaBot
Create hunting rule
File size:6'699'520 bytes
First seen:2024-02-06 22:40:14 UTC
Last seen:2024-02-07 00:54:01 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash dd36495bb5f5e338834303b9c7a50bb5 (1 x DanaBot)
ssdeep 98304:prtQdeVyH3Mw3bB5xNY+x2MYQ86CdebG2YlT:pr6devwL1i+CQ85gGNl
TLSH T14C66C022B2C4753EC46B0B395537D674A93FF76134128E3667F4888C8F359422A3A76B
TrID 47.0% (.CPL) Windows Control Panel Item (generic) (57583/11/19)
33.9% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9)
8.6% (.EXE) Win64 Executable (generic) (10523/12/4)
3.6% (.EXE) Win32 Executable (generic) (4504/4/1)
1.6% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Reporter abuse_ch
Tags:DanaBot dll


Avatar
abuse_ch
DanaBot C2:
109.234.38.247:443

Intelligence

File Origin
# of uploads :
2
# of downloads :
485
Origin country :
NL NL
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/474954/
Detection(s):
SecuriteInfo.com.Trojan.Siggen25.41635.835.17960.UNOFFICIAL
Create hunting rule

Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
89%
Tags:
danabot fingerprint hook keylogger lolbin packed rundll32 shell32 zusy
Link:
https://www.filescan.io/uploads/65c2b5862cb3f19023f2c4bf/reports/b016ba4d-d036-40d4-a31b-1ea6c54c0d76/overview
Verdict:
Malicious
Labled as:
Zusy.Generic
Link:
https://www.hybrid-analysis.com/sample/2e867f5354044d36e1fc8f47f917c7cc8ffcf00067fa313d907a67124816c9fc
Malware family:
DanaBot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/473a3b9c-9c8e-4636-b4c9-263e82224dcb
Result
Threat name:
n/a
Detection:
malicious
Classification:
phis.spyw.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/1387913
Signature
Antivirus / Scanner detection for submitted sample
May use the Tor software to hide its network traffic
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Instant Messenger accounts or passwords
Uses schtasks.exe or at.exe to add and modify task schedules
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1387913 Sample: iQ8hmxmeXu.dll Startdate: 06/02/2024 Architecture: WINDOWS Score: 84 57 Antivirus / Scanner detection for submitted sample 2->57 59 Multi AV Scanner detection for submitted file 2->59 8 loaddll32.exe 5 2->8         started        process3 signatures4 61 May use the Tor software to hide its network traffic 8->61 11 rundll32.exe 8->11         started        15 rundll32.exe 4 8->15         started        17 cmd.exe 1 8->17         started        19 6 other processes 8->19 process5 dnsIp6 53 109.234.38.247, 443, 49739, 49755 VDSINA-ASRU Russian Federation 11->53 55 46.149.77.41, 443, 49738, 49740 ASARTTELECOMRU Russian Federation 11->55 63 System process connects to network (likely due to code injection or exploit) 11->63 65 Tries to steal Instant Messenger accounts or passwords 11->65 67 Tries to harvest and steal browser information (history, passwords, etc) 11->67 21 schtasks.exe 11->21         started        23 schtasks.exe 11->23         started        25 schtasks.exe 11->25         started        35 15 other processes 11->35 69 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 15->69 71 Uses schtasks.exe or at.exe to add and modify task schedules 15->71 27 WerFault.exe 2 16 15->27         started        29 rundll32.exe 4 17->29         started        31 WerFault.exe 19->31         started        33 WerFault.exe 19->33         started        signatures7 process8 process9 37 conhost.exe 21->37         started        39 conhost.exe 23->39         started        41 conhost.exe 25->41         started        43 WerFault.exe 20 18 29->43         started        45 conhost.exe 35->45         started        47 conhost.exe 35->47         started        49 conhost.exe 35->49         started        51 12 other processes 35->51
Score:
98%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/2e867f5354044d36e1fc8f47f917c7cc8ffcf00067fa313d907a67124816c9fc
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2e867f5354044d36e1fc8f47f917c7cc8ffcf00067fa313d907a67124816c9fc/
Threat name:
Win32.Trojan.DanaBot
Create hunting rule
Status:
Malicious
First seen:
2024-02-02 19:00:00 UTC
File Type:
PE (Dll)
Extracted files:
16
AV detection:
21 of 24 (87.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=f2dh6u2uargtnyp4r5d7sf6hzsh7z4aam75dcpmqpjtresawzh6a._file
Verdict:
malicious
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/240206-2l4f2sbger/
Behaviour
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Unpacked files
SH256 hash:
d89586e88c5200d3557193167a4f35982852f90c719f969fde2a6ab32e8855ec
MD5 hash:
aad2934191e4c32773710fb2993bf4a3
SHA1 hash:
40b61b7f09d0c07d0f6488841e3250bf1aa8ba32
Detections:
Danabot
Create hunting rule
win_sinowal_w1
Create hunting rule
Link:
https://www.unpac.me/results/8c68232e-b6a7-4dda-a7dd-ebf2eec2363d/
Parent samples :
d5746f82d91620c767339b8852e42422fbe4a833c7674aedcbdb1b098d28f99a
2e867f5354044d36e1fc8f47f917c7cc8ffcf00067fa313d907a67124816c9fc
SH256 hash:
2e867f5354044d36e1fc8f47f917c7cc8ffcf00067fa313d907a67124816c9fc
MD5 hash:
119489552f8016fb96afaa3ae1b86ac3
SHA1 hash:
97cb1d48e22505634d2b7dcdf24c0f1ef04730f1
Link:
https://www.unpac.me/results/8c68232e-b6a7-4dda-a7dd-ebf2eec2363d/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2e867f5354044d36e1fc8f47f917c7cc8ffcf00067fa313d907a67124816c9fc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:adonunix2
Create hunting rule
Author:Tim Brown @timb_machine
Description:AD on UNIX
Rule name:BLOWFISH_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for Blowfish constants
Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:command_and_control
Create hunting rule
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
Rule name:DanaBot_12_2023
Create hunting rule
Author:RussianPanda
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:HeavensGate
Create hunting rule
Author:kevoreilly
Description:Heaven's Gate: Switch from 32-bit to 64-mode
Rule name:html_auto_download_b64
Create hunting rule
Author:Tdawg
Description:html auto download
Rule name:hunt_skyproj_backdoor
Create hunting rule
Author:SBousseaden
Reference:https://unit42.paloaltonetworks.com/unit42-prince-persia-ride-lightning-infy-returns-foudre/
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:QbotStuff
Create hunting rule
Author:anonymous
Rule name:Quarian
Create hunting rule
Author:Seth Hardy
Description:Quarian
Rule name:QuarianCode
Create hunting rule
Author:Seth Hardy
Description:Quarian code features
Rule name:RC6_Constants
Create hunting rule
Author:chort (@chort0)
Description:Look for RC6 magic constants in binary
Reference:https://twitter.com/mikko/status/417620511397400576
Rule name:reverse_http
Create hunting rule
Author:CD_R0M_
Description:Identify strings with http reversed (ptth)
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:WHIRLPOOL_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for WhirlPool constants
Rule name:win_sinowal_w1
Create hunting rule
Author:Seth Hardy
Description:Quarian code features

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/474954/

Comments