MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4f1af996a6a32b402d0b75a37f4412d3e2b6502ed95a4055e8a2313f83543cfa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DanaBot


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4f1af996a6a32b402d0b75a37f4412d3e2b6502ed95a4055e8a2313f83543cfa
SHA3-384 hash: e61212d473f8b9d543b9461fed23472759f426978903f768ff28ad839a9341ba44ee1150e4b1288e9349caed81b347d0
SHA1 hash: fa2442c7abef11a169088d43bd104ef6d21a12d7
MD5 hash: 31e2c3b009290449dc1fe9760c14e85b
humanhash: glucose-artist-romeo-golf
File name:31e2c3b009290449dc1fe9760c14e85b.exe
Download: download sample
Signature DanaBot
Create hunting rule
File size:1'421'968 bytes
First seen:2021-07-24 07:05:44 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash be41bf7b8cc010b614bd36bbca606973 (195 x LummaStealer, 126 x DanaBot, 63 x Vidar)
ssdeep 24576:LHs1ZNd48X5du58t0yNM8xwJAD94t5N9k6wHdK/cvy1jchAC9Z9fM:I1ZNd48nup8JDe5NZuq1jchA+tM
Threatray 420 similar samples on MalwareBazaar
TLSH T1116523847ECAEC75E8A456FB5238977322637EA40B50C307E7007C6AFB3544B5A1774A
dhash icon 71f4b0e4c0d0ec71 (1 x DanaBot)
Reporter abuse_ch
Tags:DanaBot exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
225
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
9d2eaf007ba34b9be83c74473dd771a5.exe
Verdict:
Malicious activity
Analysis date:
2021-07-24 07:11:17 UTC
Tags:
trojan stealer loader
Link:
https://app.any.run/tasks/d2ee13f2-df2d-455a-a3e2-93cb304f2972

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/173860/
Detection(s):
Win.Packed.Filerepmalware-9864117-0
Create hunting rule

Win.Packed.Stop-9872858-0
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
IntelRapid
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/03a37838-ecb6-4f54-a256-eed1dc3a9a06
Result
Threat name:
Clipboard Hijacker
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/821180
Signature
Contains functionality to register a low level keyboard hook
Delayed program exit found
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Machine Learning detection for dropped file
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Obfuscated command line found
Submitted sample is a known malware sample
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Yara detected Clipboard Hijacker
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 453589 Sample: xEm4awXzxV.exe Startdate: 24/07/2021 Architecture: WINDOWS Score: 100 59 Multi AV Scanner detection for dropped file 2->59 61 Multi AV Scanner detection for submitted file 2->61 63 Detected unpacking (changes PE section rights) 2->63 65 5 other signatures 2->65 10 xEm4awXzxV.exe 25 2->10         started        13 SmartClock.exe 2->13         started        15 SmartClock.exe 2->15         started        process3 file4 45 C:\Users\user\AppData\Local\Temp\...\vpn.exe, PE32 10->45 dropped 47 C:\Users\user\AppData\Local\Temp\...\4.exe, PE32 10->47 dropped 49 C:\Users\user\AppData\Local\Temp\...\UAC.dll, PE32 10->49 dropped 51 3 other files (none is malicious) 10->51 dropped 17 vpn.exe 7 10->17         started        19 4.exe 4 10->19         started        process5 dnsIp6 23 cmd.exe 1 17->23         started        55 192.168.2.1 unknown unknown 19->55 43 C:\Users\user\AppData\...\SmartClock.exe, PE32 19->43 dropped 26 SmartClock.exe 19->26         started        file7 process8 signatures9 67 Submitted sample is a known malware sample 23->67 69 Obfuscated command line found 23->69 71 Uses ping.exe to sleep 23->71 73 Uses ping.exe to check the status of other devices and networks 23->73 28 cmd.exe 3 23->28         started        31 conhost.exe 23->31         started        process10 signatures11 75 Obfuscated command line found 28->75 77 Uses ping.exe to sleep 28->77 33 PING.EXE 1 28->33         started        36 Disegnato.exe.com 28->36         started        38 findstr.exe 1 28->38         started        process12 dnsIp13 53 127.0.0.1 unknown unknown 33->53 40 Disegnato.exe.com 36->40         started        process14 dnsIp15 57 TKORZsPaVIforQebzpwljycLrnC.TKORZsPaVIforQebzpwljycLrnC 40->57
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4f1af996a6a32b402d0b75a37f4412d3e2b6502ed95a4055e8a2313f83543cfa/
Threat name:
Win32.Trojan.Crypzip
Create hunting rule
Status:
Malicious
First seen:
2021-07-23 18:30:14 UTC
File Type:
PE (Exe)
Extracted files:
96
AV detection:
15 of 46 (32.61%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
19c5bbe3666c5091df78c6fa71f9c84798d42d4a8386aa6de4c38a67a661c100
DanaBot
3a4f0320c6c538dbc9a22a749a81434637a1faf38a212c41206eb24f8c6ae4cd
DanaBot
7224633aec5f96349eea1bc38ae40d5cbc1d5ed120aee617efca5ba7facafa26
DanaBot
a832cae5c8de458edf6a4604d3e0e19fb74300baaeeb212227330df9e7927088
DanaBot
abaaec80f4b0d2fccb5b2c09869a9f86628b987f7369abefce67108dd1982595
DanaBot
c97d5d2645cc3028888156c99ddec9d67c3eb8812295d6f2fdd3f6e1a182f9a3
DanaBot
cfd8b67f3e21558c90c0a84d4f1f74b4691901c8e898308ce4162095b6b597fa
DanaBot
d4045dd568eec50b80e7e3679050e24cea71480500f85eb6c3a0f382716f8b0c
DanaBot
+ 410 additional samples on MalwareBazaar
Result
Malware family:
danabot
Create hunting rule
Score:
  10/10
Tags:
family:danabot botnet:4 banker discovery spyware stealer trojan
Link:
https://tria.ge/reports/210724-bl6c6jhrj6/
Behaviour
Checks processor information in registry
Modifies registry class
Modifies system certificate store
Runs ping.exe
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Suspicious use of SetThreadContext
Checks installed software on the system
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Drops startup file
Loads dropped DLL
Reads user/profile data of web browsers
Blocklisted process makes network request
Downloads MZ/PE file
Executes dropped EXE
Danabot
Malware Config
C2 Extraction:
142.11.244.124:443
142.11.206.50:443
Unpacked files
SH256 hash:
cae2af36f866fed9753ecc423bf1cfb3d1b5f2c3179dddc1715d6c896812d669
MD5 hash:
0fcc3d7408dfb7b31d8e36982dab298c
SHA1 hash:
6ebe13e8565ab5cfc7f8eac8973c156531b2a1e2
Link:
https://www.unpac.me/results/a30a7eb8-2eb3-4d64-8216-e34756e50a96/
SH256 hash:
b36dcf6aac384aa5669c7dee8ad4e89f3f5c717cae6edfc1d8802c8bbc8a5ec8
MD5 hash:
0f11836bd352d5ae89e5e9bb629591cb
SHA1 hash:
1d6b83fc59634caf6b498881b25248294f26b867
Link:
https://www.unpac.me/results/a30a7eb8-2eb3-4d64-8216-e34756e50a96/
SH256 hash:
689f1eaa54f2bf88ed1f9ee58e35a05ac64cea27086210fb5ab58cf7f645c413
MD5 hash:
6fb11909a9300abbfb772104cb18a6ab
SHA1 hash:
503255b6586d16ef2cf0e231dda6317356905d7a
Link:
https://www.unpac.me/results/a30a7eb8-2eb3-4d64-8216-e34756e50a96/
SH256 hash:
4f1af996a6a32b402d0b75a37f4412d3e2b6502ed95a4055e8a2313f83543cfa
MD5 hash:
31e2c3b009290449dc1fe9760c14e85b
SHA1 hash:
fa2442c7abef11a169088d43bd104ef6d21a12d7
Link:
https://www.unpac.me/results/a30a7eb8-2eb3-4d64-8216-e34756e50a96/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4f1af996a6a32b402d0b75a37f4412d3e2b6502ed95a4055e8a2313f83543cfa

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DanaBot

Executable exe 4f1af996a6a32b402d0b75a37f4412d3e2b6502ed95a4055e8a2313f83543cfa

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1475925/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/173860/

Comments