MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 54bfd26d068d0e2a1e654e99098d3c369ce1411825d4f4d6669bc637c2fcdbe5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

DanaBot

Vendor detections: 14

Intelligence 14 IOCs YARA 1 File information Comments

SHA256 hash:	54bfd26d068d0e2a1e654e99098d3c369ce1411825d4f4d6669bc637c2fcdbe5
SHA3-384 hash:	ae46cd2f53b506e13b70f53f3c34cea03d24ab978158dbad388ad9b3ab62e883f5bfc44a4844ab4ec7348085acbc0a61
SHA1 hash:	1fbf35f4e6b765a50e3d77fc390f2e80b5d1a445
MD5 hash:	7311953bcc80a0a4f90f9ff15e3aad8e
humanhash:	xray-carpet-winter-aspen
File name:	7311953bcc80a0a4f90f9ff15e3aad8e.exe
Download:	download sample
Signature	DanaBot Create hunting rule
File size:	2'783'232 bytes
First seen:	2023-03-19 15:54:20 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	8b512f0a0b2cd54ff600ee8ace8b2bd0 (20 x RedLineStealer, 9 x Amadey, 6 x Rhadamanthys)
ssdeep	49152:havkHJT6FkelBo2pmbxV7htH9FWZ9K9Ndc+kNjavMlEYKkAQTgC7k5E2:hxnelBYDP9rYexq7i
Threatray	4 similar samples on MalwareBazaar
TLSH	T1C2D5234393E13D48F5568B77AF1EC6E8B70EF670EE89736572289A2B0470176D1A3B40
TrID	37.3% (.EXE) Win64 Executable (generic) (10523/12/4) 17.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 16.0% (.EXE) Win32 Executable (generic) (4505/5/1) 7.3% (.ICL) Windows Icons Library (generic) (2059/9) 7.2% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):
dhash icon	0242124223424208 (1 x DanaBot)
Reporter	abuse_ch
Tags:	DanaBot exe

Intelligence

File Origin

# of uploads :

# of downloads :

273

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

danabot

ID:

File name:

7311953bcc80a0a4f90f9ff15e3aad8e.exe

Verdict:

Malicious activity

Analysis date:

2023-03-19 15:59:07 UTC

Tags:

danabot

Link:

https://app.any.run/tasks/35bfff02-f8eb-46c4-a919-d4dd12b8edd5

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/375697/

Detection(s):

Win.Packer.pkr_ce1a-9980177-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% directory

Launching a process

Creating a process with a hidden window

Creating a window

Searching for synchronization primitives

Launching the default Windows debugger (dwwin.exe)

Sending a custom TCP request

Searching for the window

Sending an HTTP GET request

Result

Malware family:

n/a

Score:

9/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/74121/overview

Behaviour

MalwareBazaar

SystemUptime

CPUID_Instruction

MeasuringTime

CheckCmdLine

EvasionGetTickCount

EvasionQueryPerformanceCounter

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

greyware packed

Link:

https://www.filescan.io/uploads/6417305b109d4db51669cec7/reports/d734ce38-3165-44e6-8189-b99ac48b189c/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/54bfd26d068d0e2a1e654e99098d3c369ce1411825d4f4d6669bc637c2fcdbe5

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

DanaBot

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/4e25afd5-7246-46c2-b19b-36f1ab3aab4c

Result

Threat name:

DanaBot

Detection:

malicious

Classification:

troj.evad

Score:

92 / 100

Link:

https://www.joesandbox.com/analysis/1197190

Signature

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Yara detected DanaBot stealer dll

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/54bfd26d068d0e2a1e654e99098d3c369ce1411825d4f4d6669bc637c2fcdbe5/

Threat name:

Win32.Trojan.Pwsx

Status:

Malicious

First seen:

2023-03-18 14:26:32 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

20 of 39 (51.28%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ks75e3igruhcuhtfj2mqtdj4g2oocqiyexkpjvtgtpddpqx43psq._file

Verdict:

malicious

DanaBot

6881828efde486122c37efd3d20ad30300f747ac1ad2bcaf2be62ef7d8add52c

DanaBot

9b6cf78552cbf1c9f7a20b73c7c3f98a6d894ecc40331b82b6ca1f42ae5dc672

DanaBot

ea0548ff7fce715749d06e5b01f434537d85fad2f3d7d89038e3f744660365ae

DanaBot

Result

Malware family:

n/a

Score:

8/10

Tags:

n/a

Link:

https://tria.ge/reports/230319-tcszysbb2z/

Behaviour

Suspicious use of WriteProcessMemory

Program crash

Loads dropped DLL

Blocklisted process makes network request

Unpacked files

SH256 hash:

baa1bd12cdb10377fdef7a85e42875540cc31425b21517017f45dc7eb0b755c5

MD5 hash:

c8dbc08922acf35420e29675afedf8d0

SHA1 hash:

9b47aaaacd651ca651dbe5d076864fb628fd4bc3

Link:

https://www.unpac.me/results/69d262ff-bc85-4a32-bf9e-2aa06f8abbcf/

SH256 hash:

e280617f55bf984b5572d23a347ae3ed9ac9e6a8d1a91247483b6edfa604a3a2

MD5 hash:

06d8248b5a7fe8d738e02dcdb21fd8bc

SHA1 hash:

dbd6750b619e77012762954596260312d8c8f330

Link:

https://www.unpac.me/results/69d262ff-bc85-4a32-bf9e-2aa06f8abbcf/

SH256 hash:

54bfd26d068d0e2a1e654e99098d3c369ce1411825d4f4d6669bc637c2fcdbe5

MD5 hash:

7311953bcc80a0a4f90f9ff15e3aad8e

SHA1 hash:

1fbf35f4e6b765a50e3d77fc390f2e80b5d1a445

Link:

https://www.unpac.me/results/69d262ff-bc85-4a32-bf9e-2aa06f8abbcf/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/54bfd26d068d0e2a1e654e99098d3c369ce1411825d4f4d6669bc637c2fcdbe5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.