MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 3e25b4da3b5de0a394d9db93d53fc0e76e0a626c5b164d58c96ca9db92547157. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
DanaBot
Vendor detections: 9
| SHA256 hash: | 3e25b4da3b5de0a394d9db93d53fc0e76e0a626c5b164d58c96ca9db92547157 |
|---|---|
| SHA3-384 hash: | f7ac76393a4fc2b3ba3dd8cbf1c91bde31833502a7c2ec10cdda59c5126546ad6c13618cf9e0c489c53570280cee9cd8 |
| SHA1 hash: | 03f291cad268cd34d0296e8be95d9f680c13e65e |
| MD5 hash: | 59108d4c5fa9d804e31c6a6926be5012 |
| humanhash: | friend-six-delta-earth |
| File name: | 59108d4c5fa9d804e31c6a6926be5012.exe |
| Download: | download sample |
| Signature | DanaBot |
| File size: | 1'120'256 bytes |
| First seen: | 2021-09-02 05:55:06 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | b9f5edd648bb5b289a01d65b4e883b6a (1 x RaccoonStealer, 1 x DanaBot, 1 x RedLineStealer) |
| ssdeep | 24576:GPRmqEsFKgiMK0gSHo2cdVJrBxusjZivulGjgdEys+4Fw:7Xg1gSHIJHVmulFTs7 |
| Threatray | 4'813 similar samples on MalwareBazaar |
| TLSH | T1AB3523977921D077E9C20A720AAACAF8CB327F9EED65C8973590375F2DB0140A760F51 |
| dhash icon | fcfcd4d4d4dcd8c0 (52 x RaccoonStealer, 28 x RedLineStealer, 6 x Smoke Loader) |
| Reporter |  abuse_ch |
| Tags: | DanaBot exe |
Intelligence
File Origin
# of uploads :
1
# of downloads :
954
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
59108d4c5fa9d804e31c6a6926be5012.exe
Verdict:
Malicious activity
Analysis date:
2021-09-02 05:58:27 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a file
Enabling the 'hidden' option for recently created files
Sending a UDP request
Launching a process
Creating a process with a hidden window
Malware family:
Malicious Packer
Verdict:
Malicious
Result
Threat name:
DanaBot
Detection:
malicious
Classification:
troj.evad
Score:
88 / 100
Signature
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Yara detected DanaBot stealer dll
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Fragtor
Status:
Malicious
First seen:
2021-09-02 05:55:12 UTC
AV detection:
23 of 45 (51.11%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
unknown
Similar samples:
+ 4'803 additional samples on MalwareBazaar
Result
Malware family:
danabot
Score:
10/10
Tags:
family:danabot banker trojan
Behaviour
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Loads dropped DLL
Blocklisted process makes network request
Danabot
Danabot Loader Component
Unpacked files
SH256 hash:
64838524335cada203e22fa91ca510456621b625b561a1ef0484d362c11f502c
MD5 hash:
6379da6b0f01b041e1b800f8eab50c66
SHA1 hash:
0ca0945f2f4b43e11f8eee27044119425054b0dc
SH256 hash:
09aaa29401e23eef30f55a3fcbb871741c3b298e1caf35df3c0be42442dfe9c3
MD5 hash:
a015a6c18968eae925df7e5b5a0858eb
SHA1 hash:
ef08f95baafb8929451bf52357ec63caf00af94f
SH256 hash:
3e25b4da3b5de0a394d9db93d53fc0e76e0a626c5b164d58c96ca9db92547157
MD5 hash:
59108d4c5fa9d804e31c6a6926be5012
SHA1 hash:
03f291cad268cd34d0296e8be95d9f680c13e65e
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.