MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3ed7f7762df8bb34c7e6ad2bc81bc5b556dd8d296c2f930368a9566f6d6a5110. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DanaBot


Vendor detections: 13


Intelligence 13 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3ed7f7762df8bb34c7e6ad2bc81bc5b556dd8d296c2f930368a9566f6d6a5110
SHA3-384 hash: 5f521359d88a66eeac58cb2eb9f4c80f0cc693b655ba44ffedd3ede69eced7ea21e18009fad0721b81d3164fbe06646d
SHA1 hash: a195098800305a392af526d9cd059b970fd096df
MD5 hash: 611ffbc5081fb41a014b093b7116666f
humanhash: delta-alpha-yankee-sad
File name:611ffbc5081fb41a014b093b7116666f.exe
Download: download sample
Signature DanaBot
Create hunting rule
File size:1'169'408 bytes
First seen:2021-10-17 07:22:43 UTC
Last seen:2021-10-17 08:18:37 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash a99f04f64de24d5e1a562ded934b0bcc (1 x DanaBot)
ssdeep 24576:cl5lI1vY76Z2R4LABfH8h8vV5UDEPDRFHLk7E3yTdLOX:1Y7E+4LAB0hMntpw71
TLSH T10A451210B6B0C035E1B657F409B696ADB93F3AB1A72152CF23C916EA1A359D1FC7034B
File icon (PE):PE icon
dhash icon e0e8e8e8aa62a499 (12 x RaccoonStealer, 9 x RedLineStealer, 7 x ArkeiStealer)
Reporter abuse_ch
Tags:DanaBot exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
558
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
boopa.exe
Verdict:
Malicious activity
Analysis date:
2021-10-16 18:52:03 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/29ed7170-5b87-4607-a837-4e3a2346deb8

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
DanaBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/197955/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.37811060.13560.8658.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file
Enabling the 'hidden' option for recently created files
Launching a process
Creating a process with a hidden window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/616bcf5bdb358dd15ebd91ef/reports/c7f0178d-929d-4295-8013-b59d2ba55710/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b4735795-50d1-4282-bf96-a0abfe79406c
Result
Threat name:
DanaBot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/871743
Signature
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Yara detected DanaBot stealer dll
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3ed7f7762df8bb34c7e6ad2bc81bc5b556dd8d296c2f930368a9566f6d6a5110/
Threat name:
Win32.Packed.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-10-17 02:00:00 UTC
AV detection:
13 of 28 (46.43%)
Threat level:
  1/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=h3l7o5rn7c5tjr7gvuv4qg6fwvln3djjnqxzga3ivflg63lkkeia._file
Verdict:
malicious
Result
Malware family:
danabot
Create hunting rule
Score:
  10/10
Tags:
family:danabot banker trojan
Link:
https://tria.ge/reports/211017-h7tdesdcbl/
Behaviour
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Loads dropped DLL
Blocklisted process makes network request
Danabot
Danabot Loader Component
Malware Config
C2 Extraction:
192.119.110.73:443
192.236.147.159:443
192.210.222.88:443
Unpacked files
SH256 hash:
55b781414ee01c972000e0e9c7c3368411303eaf2ad7c3e69fde10a857765693
MD5 hash:
250b7ba8580870dc52ad32562aa27210
SHA1 hash:
3258833b884dcdf828b10ab55111fca1d8b92103
Link:
https://www.unpac.me/results/f9be92f4-17ec-4ffd-8d3e-52e8054ee0fb/
SH256 hash:
7979210c2e23fe4d4791023a49eaea8a21d09114ef4b9327a0fcacae509aca2f
MD5 hash:
2653d6c06d9c4e34e83a89fb8d714634
SHA1 hash:
4e120c5117c9fe7a8e1e138aae4baafff8de91a0
Link:
https://www.unpac.me/results/f9be92f4-17ec-4ffd-8d3e-52e8054ee0fb/
SH256 hash:
3ed7f7762df8bb34c7e6ad2bc81bc5b556dd8d296c2f930368a9566f6d6a5110
MD5 hash:
611ffbc5081fb41a014b093b7116666f
SHA1 hash:
a195098800305a392af526d9cd059b970fd096df
Link:
https://www.unpac.me/results/f9be92f4-17ec-4ffd-8d3e-52e8054ee0fb/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3ed7f7762df8bb34c7e6ad2bc81bc5b556dd8d296c2f930368a9566f6d6a5110

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DanaBot

Executable exe 3ed7f7762df8bb34c7e6ad2bc81bc5b556dd8d296c2f930368a9566f6d6a5110

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1660814/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/197955/

Comments