MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 311a51eef668a68b50238afa2b983f99d8c92149493a63a9aaf64205cee2267b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 311a51eef668a68b50238afa2b983f99d8c92149493a63a9aaf64205cee2267b
SHA3-384 hash: a545c61b995a8ff9b64fbb41f8619ac49ed18df6edbca9d90e0853f488441112e0a675c3394424a0968dbbcafe967804
SHA1 hash: f7ea6d5eb0cdecdc3ae1c550f7d3430cb490432c
MD5 hash: f679b1ac6c3352b57474d05c88c80133
humanhash: coffee-black-saturn-jig
File name:nq8qKG6gEK7T9JHBQ7UA.exe
Download: download sample
File size:5'434'344 bytes
First seen:2021-02-04 02:55:11 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash be41bf7b8cc010b614bd36bbca606973 (195 x LummaStealer, 126 x DanaBot, 63 x Vidar)
ssdeep 98304:kgRak6TUMAt6VBKODBA1iL65s5sxpA3mY9ChszLY3h7Hy:bR6A7tigoAw6OG69CGzLYx7S
Threatray 52 similar samples on MalwareBazaar
TLSH 784633A65B57E3F3E42A5D371BE353C2C8ACEC93450EC94A9350788E99335D1DD302AA
Reporter vm001cn

Intelligence

File Origin
# of uploads :
1
# of downloads :
109
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/115473/
Detection(s):
SecuriteInfo.com.EXE.Obfus-4.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Creating a window
Creating a process from a recently created file
Deleting a recently created file
Searching for analyzing tools
Searching for the window
Sending a UDP request
Creating a file in the %AppData% subdirectories
DNS request
Sending an HTTP GET request
Creating a file
Sending a custom TCP request
Running batch commands
Creating a process with a hidden window
Launching a process
Enabling autorun by creating a file
Sending an HTTP GET request to an infection source
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Cryptbot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/598666
Signature
Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
Hides threads from debuggers
Machine Learning detection for dropped file
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Potentially malicious time measurement code found
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Yara detected Cryptbot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 348362 Sample: nq8qKG6gEK7T9JHBQ7UA.exe Startdate: 04/02/2021 Architecture: WINDOWS Score: 100 41 cdn.onenote.net 2->41 51 Antivirus detection for dropped file 2->51 53 Multi AV Scanner detection for dropped file 2->53 55 Multi AV Scanner detection for submitted file 2->55 57 9 other signatures 2->57 8 nq8qKG6gEK7T9JHBQ7UA.exe 20 2->8         started        11 SmartClock.exe 2->11         started        14 SmartClock.exe 2->14         started        signatures3 process4 file5 33 C:\Users\user\AppData\Local\...\vpn_ico.exe, PE32 8->33 dropped 35 C:\Users\user\AppData\Local\...\6_ico.exe, PE32 8->35 dropped 37 C:\Users\user\AppData\Local\...\4_ico.exe, PE32 8->37 dropped 39 C:\Users\user\AppData\Local\Temp\...\UAC.dll, PE32 8->39 dropped 16 4_ico.exe 4 8->16         started        20 vpn_ico.exe 3 19 8->20         started        23 6_ico.exe 3 8->23         started        65 Hides threads from debuggers 11->65 67 Tries to detect sandboxes / dynamic malware analysis system (registry check) 11->67 signatures6 process7 dnsIp8 31 C:\Users\user\AppData\...\SmartClock.exe, PE32 16->31 dropped 47 Hides threads from debuggers 16->47 49 Tries to detect sandboxes / dynamic malware analysis system (registry check) 16->49 25 SmartClock.exe 16->25         started        43 ip-api.com 208.95.112.1, 49723, 80 TUT-ASUS United States 20->43 28 wscript.exe 12 20->28         started        file9 signatures10 process11 dnsIp12 59 Hides threads from debuggers 25->59 61 Tries to detect sandboxes / dynamic malware analysis system (registry check) 25->61 45 iplogger.org 88.99.66.31, 443, 49726 HETZNER-ASDE Germany 28->45 63 System process connects to network (likely due to code injection or exploit) 28->63 signatures13
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/311a51eef668a68b50238afa2b983f99d8c92149493a63a9aaf64205cee2267b/
Threat name:
Win32.Backdoor.Bladabhindi
Create hunting rule
Status:
Malicious
First seen:
2021-02-04 02:56:07 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
1ba569c631438a0fb356441838ff328835d607e7cdb217cc444923c1ec58337b
23b038034753de2b160a1039ad4f724f0cb75d57d0f73af56d592850c82a20cb
36192aaa605b98f67d88d3712e5eb7ddd8e229766bbae3b2efebdb98f19662ea
37cb831726dc1877ea59cf5618e4fa224368bbd64a7047dec6fb554a6a17d4c2
57e0906e3b6e13fe8db13cc06ce37d957bfc045afa6e99e9cf8b893ceb57d018
5c7291c8c0c9aae91453faabe543abd6da50a2600ba74cd9fd1faa18a939cd4b
7c3c41d8da242f6ae707daaf842c0c0afb4ff541e3b009c62e51bc7d93eca86b
ada1c5359c35e6b70c5a2d5533f9d725f86a1e155c8486bfd2941c9b40478ea2
adc220109f73acdd307036a6d14bffa68103a48e2305c3a4f1533aab74d9deb8
b0c5153cf37bc26d5845c41dd969822cfc272186c49f0b447060259787bf024a
+ 42 additional samples on MalwareBazaar
Result
Malware family:
danabot
Create hunting rule
Score:
  10/10
Tags:
family:danabot banker discovery evasion ransomware spyware trojan
Link:
https://tria.ge/reports/210204-lk378x5m6s/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Modifies registry class
Modifies system certificate store
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks installed software on the system
Drops desktop.ini file(s)
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Checks BIOS information in registry
Drops startup file
Identifies Wine through registry keys
Loads dropped DLL
Reads user/profile data of web browsers
Blocklisted process makes network request
Executes dropped EXE
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Danabot
Malware Config
C2 Extraction:
193.34.167.163:443
78.138.98.136:443
134.119.186.198:443
172.93.201.39:443
Unpacked files
SH256 hash:
311a51eef668a68b50238afa2b983f99d8c92149493a63a9aaf64205cee2267b
MD5 hash:
f679b1ac6c3352b57474d05c88c80133
SHA1 hash:
f7ea6d5eb0cdecdc3ae1c550f7d3430cb490432c
Link:
https://www.unpac.me/results/59ad073f-7990-413e-bd69-f943612b3a5e/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Swisyn
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/311a51eef668a68b50238afa2b983f99d8c92149493a63a9aaf64205cee2267b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/115473/

Comments