MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 5c07027df41a91d027a90ff85f445cc038127d8b035bbfc6569644c1d4ec6156. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
DanaBot
Vendor detections: 12
| SHA256 hash: | 5c07027df41a91d027a90ff85f445cc038127d8b035bbfc6569644c1d4ec6156 |
|---|---|
| SHA3-384 hash: | 75232b7a112dec722743229366ab7a1bc1ff1faa163300e927c441e7f04e7019cb602c909b8c105f1217858556060274 |
| SHA1 hash: | 9b2c78810e575f081fa9b7623c2a2e879cf4fbe4 |
| MD5 hash: | 4eebee09173ff96dbe8390c822cd2eef |
| humanhash: | minnesota-zebra-yellow-florida |
| File name: | 5C07027DF41A91D027A90FF85F445CC038127D8B035BB.exe |
| Download: | download sample |
| Signature | DanaBot |
| File size: | 4'867'078 bytes |
| First seen: | 2022-03-31 15:41:57 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 65cdd970d73381f4b594a626a242a94a (1 x DanaBot) |
| ssdeep | 98304:75C/x8Dv29+nQozTiMhi1UguA5I8735DBS8t2RqFqwQ6HBkGqbCqu:IivCYQozTeuA5I8D5DlHuGqc |
| Threatray | 438 similar samples on MalwareBazaar |
| TLSH | T16C3633221221C0B2D486457A854AC9D8DEBAB8310D5DAF473F484E7F6D267F35F0A3E6 |
| File icon (PE): |  |
| dhash icon | b0bcd86cdcc4d4dc (1 x DanaBot) |
| Reporter |  abuse_ch |
| Tags: | DanaBot exe |
Indicators Of Compromise (IOCs)
Below is a list of indicators of compromise (IOCs) associated with this malware samples.
| IOC | ThreatFox Reference |
|---|---|
| 86.105.252.18:443 | https://threatfox.abuse.ch/ioc/472628/ |
Intelligence
File Origin
# of uploads :
1
# of downloads :
667
Origin country :
n/a
Vendor Threat Intelligence
Detection:
DanaBot
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Сreating synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Searching for synchronization primitives
Changing a file
Creating a window
Modifying an executable file
Sending a custom TCP request
Searching for the window
Infecting executable files
Result
Malware family:
n/a
Score:
9/10
Tags:
n/a
Behaviour
MalwareBazaar
SystemUptime
MeasuringTime
CPUID_Instruction
EvasionGetTickCount
CheckCmdLine
EvasionQueryPerformanceCounter
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
azorult emotet glupteba lockbit packed ursnif
Malware family:
DanaBot
Verdict:
Malicious
Result
Threat name:
DanaBot
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Behaviour
Behavior Graph:
n/a
Detection:
danabot
Threat name:
Win32.Trojan.Glupteba
Status:
Malicious
First seen:
2021-08-11 01:37:04 UTC
File Type:
PE (Exe)
Extracted files:
5
AV detection:
37 of 42 (88.10%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Similar samples:
+ 428 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
8/10
Tags:
discovery spyware stealer
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Checks installed software on the system
Drops desktop.ini file(s)
Deletes itself
Loads dropped DLL
Reads user/profile data of web browsers
Blocklisted process makes network request
Unpacked files
SH256 hash:
75258b47e43fb8f5f89d8ad2fae19ce0e19d7132c105c002b370bf3c4d63f11f
MD5 hash:
e6b8e2156a4644737bddc1d448eb7f9c
SHA1 hash:
3e832746d9c135a5aaa3b70641c442fa6c9773fe
SH256 hash:
7a9c21fbb90a59cf1e3f441da1bb50747d3640848b4e81633d681c4dcd3f2820
MD5 hash:
e808d8d7c58ba9976bef24c39d46d937
SHA1 hash:
a9a0124804e066e5deac7eb01ad2766ab9421ff3
SH256 hash:
ff5bc538cac151a8788d0d8e7988a3e92bd2e51aa4e86ea2edcfae0a53d50036
MD5 hash:
55a2cfe2ec09f90f9e57f1c944adeab0
SHA1 hash:
7183255b91c0ef8e9f1686cb3f72ce9f0eff8718
SH256 hash:
5c07027df41a91d027a90ff85f445cc038127d8b035bbfc6569644c1d4ec6156
MD5 hash:
4eebee09173ff96dbe8390c822cd2eef
SHA1 hash:
9b2c78810e575f081fa9b7623c2a2e879cf4fbe4
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | hunt_skyproj_backdoor |
|---|---|
| Author: | SBousseaden |
| Reference: | https://unit42.paloaltonetworks.com/unit42-prince-persia-ride-lightning-infy-returns-foudre/ |
| Rule name: | INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients |
|---|---|
| Author: | ditekSHen |
| Description: | Detects executables referencing many email and collaboration clients. Observed in information stealers |
| Rule name: | INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients |
|---|---|
| Author: | ditekSHen |
| Description: | Detects executables referencing many file transfer clients. Observed in information stealers |
| Rule name: | INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore |
|---|---|
| Author: | ditekSHen |
| Description: | Detects executables containing SQL queries to confidential data stores. Observed in infostealers |
| Rule name: | INDICATOR_SUSPICIOUS_PWSH_PasswordCredential_RetrievePassword |
|---|---|
| Author: | ditekSHen |
| Description: | Detects PowerShell content designed to retrieve passwords from host |
| Rule name: | MALWARE_Win_DanaBot |
|---|---|
| Author: | ditekSHen |
| Description: | Detects DanaBot variants |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.