MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4e36dc0d37ead94cbd7797668c3c240ddc00fbb45c18140d370c868915b8469d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DanaBot


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4e36dc0d37ead94cbd7797668c3c240ddc00fbb45c18140d370c868915b8469d
SHA3-384 hash: 51011889efb1e1e8d4a0b66f3c47f57ae3f55ff72b96d0f734bc2020a34ad4db7c8a06af4e4d6f0eace3c62f09d386e3
SHA1 hash: 7c3e46cd7c93f3d9d783888f04f1607f6e487783
MD5 hash: ec7506c2b6460df44c18e61d39d5b1c0
humanhash: triple-ohio-solar-fanta
File name:ec7506c2b6460df44c18e61d39d5b1c0.exe
Download: download sample
Signature DanaBot
Create hunting rule
File size:2'700'800 bytes
First seen:2020-05-30 09:23:57 UTC
Last seen:2020-05-30 10:06:22 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash c7c73570622623fdc43131852582ef2b (1 x DanaBot)
ssdeep 49152:kBAxF8n3cdlgjGgwrHzdszaZ5E6UKB5xipj6qKBlqX:kBECaNTdvzI61Blq
Threatray 68 similar samples on MalwareBazaar
TLSH 65C533C35BB05870D16644F0F28075334BD99CA2ABA0978EF644AF0F6FF738255A469B
Reporter abuse_ch
Tags:DanaBot exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
845
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Generic.mg.ec7506c2b6460df4.1331.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-29 23:25:44 UTC
AV detection:
18 of 31 (58.06%)
Threat level:
  2/5
Verdict:
malicious
Similar samples:
219ce23454e6209702f4795e16765681936d2e4e4166c601a2ac412b15f4c1a5
DanaBot
720b101eeb0fd61433a644563ad541e1923a202a1116fda126534e89a805136c
DanaBot
8b5118ba1223c3aa351e6def9781aa38a8ee565c6103c9e8db9c0db392afc6f5
DanaBot
91f107648a048f50e25c350d3e2c6c94e3f39775815179e011fed5548fde7917
DanaBot
94b9908c1d164acb68a30bacada251782c6e9dc64500718d12ebe4abf871b305
DanaBot
a13c95a98b340edd7eeeff2da8272761cd84d093f43888e5940451d02b1a2dc0
DanaBot
a7c37af821063d0a3be82a621e332f48c89bd83bec9c3ad092d4e357813c7e66
DanaBot
abd75572f897cdda88cec22922d15b509ee8c840fa5894b0aecbef6de23908a3
DanaBot
d447a466b5bed2daffcd7a3ea6fea93a8d9fa32d62eadbf834d3a8713da05a4a
DanaBot
e4719e8d66fb27cb0a1f2168f22fdb0e1aa14058e82662ed61aa3bbe66f6a34e
DanaBot
+ 58 additional samples on MalwareBazaar
Result
Malware family:
danabot
Create hunting rule
Score:
  10/10
Tags:
family:danabot banker botnet trojan
Link:
https://tria.ge/reports/201109-35m4lfb6ds/
Behaviour
Suspicious use of WriteProcessMemory
Loads dropped DLL
Blacklisted process makes network request
Danabot
Danabot x86 payload
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DanaBot

Executable exe 4e36dc0d37ead94cbd7797668c3c240ddc00fbb45c18140d370c868915b8469d

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/367844/
  
Delivery method
Distributed via web download

Comments