MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 31a18887102d71eaea7c51ba2e52093090ba414ef837cf04297dc147475a620e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DanaBot


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 31a18887102d71eaea7c51ba2e52093090ba414ef837cf04297dc147475a620e
SHA3-384 hash: f95849a4c85616ddc16bd6e0c5ecaddf771d26a42388aa770f6035dc99a7b5b51a0a647a2595ab17102c963b526fb2df
SHA1 hash: 51d8507936e409d3e31dcb8158471acbc02ea6d4
MD5 hash: 74f67497175633d50b6397e61654ccf5
humanhash: echo-east-carolina-oklahoma
File name:74f67497175633d50b6397e61654ccf5.exe
Download: download sample
Signature DanaBot
Create hunting rule
File size:991'232 bytes
First seen:2022-04-13 07:09:02 UTC
Last seen:2022-04-13 08:00:48 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 7f83c3d2c71504a0c9bb3a99cae3fb31 (5 x RedLineStealer, 1 x N-W0rm, 1 x DanaBot)
ssdeep 24576:BMZJXnZZdREXlGD22XL+d5w+Nblp4B0i:BGZdCyL+QB0
Threatray 1'534 similar samples on MalwareBazaar
TLSH T19E25231237D1C072E0636632EA199E61DCA4B92353F5464B3BA45F7B0FB06C05BB9B4A
File icon (PE):PE icon
dhash icon fcf8b4b4b494d9c1 (17 x Smoke Loader, 8 x RedLineStealer, 6 x Amadey)
Reporter abuse_ch
Tags:DanaBot exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
751
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
danabot
Create hunting rule
ID:
1
File name:
74f67497175633d50b6397e61654ccf5.exe
Verdict:
Malicious activity
Analysis date:
2022-04-13 08:26:29 UTC
Tags:
danabot stealer trojan
Link:
https://app.any.run/tasks/7a5a5665-1b42-4739-b147-bdfa130518d4

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/263318/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.39487905.17559.22383.UNOFFICIAL
Create hunting rule

Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Creating a window
Launching a process
Sending a custom TCP request
Sending an HTTP GET request
Creating a file in the %temp% directory
Сreating synchronization primitives
Unauthorized injection to a system process
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/13726/overview
Behaviour
SystemUptime
MeasuringTime
EvasionQueryPerformanceCounter
CheckCmdLine
EvasionGetTickCount
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/6256771bffe27d5119bedc20/reports/bc9218ac-70ac-4cf9-b4ba-99ea59e52a39/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
DanaBot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/79573c6c-28d5-497a-a668-2a7bf7dcfd56
Result
Threat name:
DanaBot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/975952
Signature
Delayed program exit found
Machine Learning detection for sample
May use the Tor software to hide its network traffic
Multi AV Scanner detection for submitted file
Overwrites code with function prologues
Sigma detected: Suspicious Call by Ordinal
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Yara detected DanaBot stealer dll
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/31a18887102d71eaea7c51ba2e52093090ba414ef837cf04297dc147475a620e/
Threat name:
Win32.Ransomware.StopCrypt
Create hunting rule
Status:
Malicious
First seen:
2022-04-13 07:10:09 UTC
File Type:
PE (Exe)
Extracted files:
14
AV detection:
21 of 26 (80.77%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
0f8d2648166184bde6562f33b7e4b620313fe7a21746720d37594213fba7a604
DanaBot
157757f5065076824ea142b1e3910b51326149a0a457f986cc4270b5fec1d319
DanaBot
9310daf6d10f4fbfaf390e74bcf1c4d9acc023d7db3e26030f8772528572a22a
DanaBot
9469034627434b3aad5d88683729e7e8bafc2078ab62758808da1f2727999dc7
DanaBot
a71159cffa18ebb762f121760decde078c80061237c1f7bd3928787c258fba4f
DanaBot
c72aa9c4df96e6768a8a1db299a8e787ac729faa40c536fa4344f82d4670a947
DanaBot
d3692d3823bd5e165d88e97bb2c2673489ff76fb873bb28543a2f233c9fe4ff9
DanaBot
e1511e934906072c0717e68c0a05b04c61846f7ad15ce323b61f854a24c86b15
DanaBot
+ 1'524 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/220413-kz3cgaeag4/
Behaviour
Checks processor information in registry
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Blocklisted process makes network request
Unpacked files
SH256 hash:
fa53e6821a58ab17cfca58ca59184b2ccd4dc3acee4855039d51ee2a28b89e56
MD5 hash:
338cf601768b723a8604f0fb7a08c402
SHA1 hash:
164dfae9258f44e03fe55119bde04f95edfb2393
Link:
https://www.unpac.me/results/9104c0d9-4ba2-44ab-9e55-c9906fbbd077/
SH256 hash:
31a18887102d71eaea7c51ba2e52093090ba414ef837cf04297dc147475a620e
MD5 hash:
74f67497175633d50b6397e61654ccf5
SHA1 hash:
51d8507936e409d3e31dcb8158471acbc02ea6d4
Link:
https://www.unpac.me/results/9104c0d9-4ba2-44ab-9e55-c9906fbbd077/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/31a18887102d/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/31a18887102d71eaea7c51ba2e52093090ba414ef837cf04297dc147475a620e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/263318/

Comments