MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 445bd58d9f401c7fb7d977e9b74cc002e5b892ba355f5c00e122cc48b404bac2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DanaBot


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 445bd58d9f401c7fb7d977e9b74cc002e5b892ba355f5c00e122cc48b404bac2
SHA3-384 hash: 3f477969f444fbb4a08e94326a77e55bd6265294ad708e3c5d940db25019c0c5b9dd6355541889b0334236c9d15fcc05
SHA1 hash: 8a8b036d0a48acb9b685df15e5068de48df705ca
MD5 hash: 28ed6bbb727cd4066fb3aa4ec76fd8c0
humanhash: xray-sixteen-fifteen-mobile
File name:28ed6bbb727cd4066fb3aa4ec76fd8c0.exe
Download: download sample
Signature DanaBot
Create hunting rule
File size:2'749'952 bytes
First seen:2020-06-10 05:44:59 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 01ec89a8b38864ce2dba1f8505a02615 (1 x DanaBot)
ssdeep 49152:TOuNUtvsygQbydM1BiTp4gOOtbYnIUf14sWK5mlhIluzHpmTgRWRo:pukO1aV8OtbAf1jcIluzgTgR
Threatray 72 similar samples on MalwareBazaar
TLSH 10D5232376E1F4B6D177AE7254649B801BBFFA2B1F715C86224C082B5A3C9D19F34B81
Reporter abuse_ch
Tags:DanaBot exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
881
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Ursu.897761.32686.10853.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Danabot
Create hunting rule
Status:
Malicious
First seen:
2020-06-10 00:57:07 UTC
AV detection:
26 of 30 (86.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=irn5ldm7iaoh7n6zo7u3otgaals3rev2gvpvyahbelgernaexlba._file
Verdict:
malicious
Similar samples:
1464f141847f0ee9af9f7f2eda69ebcb56022ae8b1d259bb152a873d3c6a303d
DanaBot
3e6c762ae623b985932a24c99a901dfb7dcb7c452bd5668bf2d7e8883f99381f
DanaBot
4f9b6310c363bc29667d6624f373a78762061fe952494a242454be6550c374da
DanaBot
5128943bdbc08a1f56d6ca3c7be3ac65e7080341a2268c55e4280cee005505c0
DanaBot
95a90fbde8c6cc25ac3ebbc1bc9602a8a656a6c6d29e47378cca197c7018df02
DanaBot
98c2f70c665efdfe6ff95460c0c8f131e80de91cf6dcbcf8bb4209c330280262
DanaBot
9d96347ba7dd239d6a6b667242965905d6e96114281cd7a18812e901712a8303
DanaBot
a59a10879e0a2db88c6ea80f31a85962b7e4e89b6e2c4d4cac459b1580422b78
DanaBot
ba3478006a8f45f9979a6f2f363933093cd063f7845c85dc604c374481347c20
DanaBot
cd38592468e54623dc5c89529203dbc21ede6cfe95523d2f146449019288038c
DanaBot
+ 62 additional samples on MalwareBazaar
Result
Malware family:
danabot
Create hunting rule
Score:
  10/10
Tags:
family:danabot banker botnet trojan
Link:
https://tria.ge/reports/201109-dd12ckq616/
Behaviour
Suspicious use of WriteProcessMemory
Loads dropped DLL
Blacklisted process makes network request
Danabot
Danabot x86 payload
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_danabot_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DanaBot

Executable exe 445bd58d9f401c7fb7d977e9b74cc002e5b892ba355f5c00e122cc48b404bac2

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/367844/
  
Delivery method
Distributed via web download

Comments