MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4c8f7f648ac179d6087109bd711326f7139bee639c9092d942c79dd5a1886a83. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

DanaBot

Vendor detections: 12

Intelligence 12 IOCs YARA 1 File information Comments

SHA256 hash:	4c8f7f648ac179d6087109bd711326f7139bee639c9092d942c79dd5a1886a83
SHA3-384 hash:	ccabc2b594a6d675754a3944129e1efe240dd25008af4229ec2230f13f8a721e6d7b40600acd87f2e3305519d0799dc2
SHA1 hash:	57af58a7360cdf05a521f7da19991867a704cdc7
MD5 hash:	8537340c4909174b7e4ef04853b8d595
humanhash:	eighteen-low-fanta-august
File name:	SecuriteInfo.com.W32.AIDetect.malware1.17490.29215
Download:	download sample
Signature	DanaBot Create hunting rule
File size:	1'963'008 bytes
First seen:	2022-08-20 16:39:14 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	40e251bb683316a044ede7b4e5c71905 (4 x Stop, 4 x DanaBot, 1 x CoinMiner)
ssdeep	49152:V9zqhNlIXacEx3n8y0r4GXE5pd+y+EoS/lR6Ow8RP:V9OhNOBEx3n8yZGXCzdPr/lR6O
Threatray	507 similar samples on MalwareBazaar
TLSH	T1B9952354E750C03DE1B726F4786B93B8B9293E822B5050CF62D23EDE5630AE4EDB4257
TrID	32.2% (.EXE) Win64 Executable (generic) (10523/12/4) 20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 15.4% (.EXE) Win16 NE executable (generic) (5038/12/1) 13.7% (.EXE) Win32 Executable (generic) (4505/5/1) 6.2% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):
dhash icon	b2dacabecee6baa6 (148 x RedLineStealer, 145 x Stop, 100 x Smoke Loader)
Reporter	SecuriteInfoCom
Tags:	DanaBot exe

Intelligence

File Origin

# of uploads :

# of downloads :

544

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

danabot

ID:

File name:

SecuriteInfo.com.W32.AIDetect.malware1.17490.29215

Verdict:

Malicious activity

Analysis date:

2022-08-20 16:40:13 UTC

Tags:

danabot

Link:

https://app.any.run/tasks/f92391e9-1d63-4d57-b614-ed3d2e057370

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/299948/

Detection(s):

SecuriteInfo.com.W32.AIDetect.malware1.17490.29215.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% directory

Launching a process

Creating a process with a hidden window

Launching the default Windows debugger (dwwin.exe)

Creating a window

Sending a custom TCP request

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

greyware packed smoke

Link:

https://www.filescan.io/uploads/63010ea53cbb13868a66097a/reports/e9670955-1c37-44b7-b59b-c8413ad8cf02/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

DanaBot

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/1606d70a-127a-49c5-89f6-3dd1290125c8

Result

Threat name:

DanaBot

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1054857

Signature

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected DanaBot stealer dll

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4c8f7f648ac179d6087109bd711326f7139bee639c9092d942c79dd5a1886a83/

Threat name:

Win32.Trojan.Strab

Status:

Malicious

First seen:

2022-08-20 16:40:11 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

20 of 26 (76.92%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=jshx6zekyf45mcdrbg6xcezg64jzx3tdtsijfwkcy6o5liminkbq._file

Verdict:

malicious

Result

Malware family:

danabot

Score:

10/10

Tags:

family:danabot banker trojan

Link:

https://tria.ge/reports/220820-t6jclsgfh6/

Behaviour

Suspicious use of WriteProcessMemory

Program crash

Loads dropped DLL

Blocklisted process makes network request

Danabot

Malware Config

C2 Extraction:

192.236.155.159:443
192.236.162.2:443
104.168.247.161:443
184.95.48.11:443

Unpacked files

SH256 hash:

dc817fc49c1fa7615ebb5515e3f569a72db62ba4651a1d854ec206c96d7dd4ee

MD5 hash:

8a03f0c27de496b2e9a80834b8595229

SHA1 hash:

7466f967857c680eebd498792b6044e3be0e2f71

Link:

https://www.unpac.me/results/acfb60ea-30cf-4ef4-9098-4884ee930c37/

SH256 hash:

291a3fb93566c8bce520876af6881bdb5cec29108b11895d96c85699c6b8d2a2

MD5 hash:

f4abc1d0b87e4f06deb47444149dace9

SHA1 hash:

3b0f042de260ce358f1b406a0ccfabb2f12b1bd2

Link:

https://www.unpac.me/results/acfb60ea-30cf-4ef4-9098-4884ee930c37/

SH256 hash:

4c8f7f648ac179d6087109bd711326f7139bee639c9092d942c79dd5a1886a83

MD5 hash:

8537340c4909174b7e4ef04853b8d595

SHA1 hash:

57af58a7360cdf05a521f7da19991867a704cdc7

Link:

https://www.unpac.me/results/acfb60ea-30cf-4ef4-9098-4884ee930c37/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/4c8f7f648ac179d6087109bd711326f7139bee639c9092d942c79dd5a1886a83

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.