MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5d48b2614aaaebab4a97deafbd3117e2baa62aaf6a357003b10554e3caa60f5a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DanaBot


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5d48b2614aaaebab4a97deafbd3117e2baa62aaf6a357003b10554e3caa60f5a
SHA3-384 hash: f74d1077e8468ad200f84b5de26c358bcb69447ae7b25150cdd072f54fea57914447663e9b1a085cfb7df6d90ea4f2b1
SHA1 hash: 426d0806320d005938fc7c698291bd6b9cca46ea
MD5 hash: 2bce3c8efb3cb62fe2537ba2ff92030a
humanhash: iowa-stream-quebec-edward
File name:2bce3c8efb3cb62fe2537ba2ff92030a.exe
Download: download sample
Signature DanaBot
Create hunting rule
File size:1'250'816 bytes
First seen:2021-10-03 07:31:20 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f37786a16a90f8f3f38c22c48ff5cfc1 (7 x RaccoonStealer, 2 x RedLineStealer, 1 x DanaBot)
ssdeep 24576:e/M1biswUmqkRGN+F9G1N1FI7GuzRDGTuDddBoCZ/QU1or4rz1yjL6L:eAbisHNI9WHFscToBoqQU1oc/f
Threatray 5'914 similar samples on MalwareBazaar
TLSH T1CF4512297681CEB2C6B402B0AB16C7F0597DFD581D1B714BBA98371EBE3E381E711246
File icon (PE):PE icon
dhash icon 4839b234e8c38890 (121 x RaccoonStealer, 54 x RedLineStealer, 51 x ArkeiStealer)
Reporter abuse_ch
Tags:DanaBot exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
241
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
2bce3c8efb3cb62fe2537ba2ff92030a.exe
Verdict:
Malicious activity
Analysis date:
2021-10-03 07:56:00 UTC
Tags:
trojan danabot
Link:
https://app.any.run/tasks/5ecac314-74b5-4201-bc95-0fe9964ea3a0

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
DanaBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/194312/
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware2.12160.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file
Enabling the 'hidden' option for recently created files
Launching a process
Creating a process with a hidden window
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b0c056de-b198-4cd5-a77a-e5c2db71a562
Result
Threat name:
DanaBot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/863366
Signature
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Yara detected DanaBot stealer dll
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5d48b2614aaaebab4a97deafbd3117e2baa62aaf6a357003b10554e3caa60f5a/
Threat name:
Win32.Ransomware.LockbitCrypt
Create hunting rule
Status:
Malicious
First seen:
2021-10-03 06:18:46 UTC
AV detection:
20 of 45 (44.44%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
002fc4fa3de071983f37c2d4c81d2eae2ea27351c59193ba79451b2674718643
DanaBot
0cbc99017336a7e835494b822f84821254a78b0ae7dea476ed98bca861b1936b
DanaBot
0fa94fb3399528ee6652f3852baac8c399f267ed82ff74730881400494477a83
DanaBot
2e4bb0047b59d9a3e77d0543ac0acac8777e03c354dc5e0e94ab19c74c06f179
DanaBot
4b735599ef5aac480c58627f4b72af26cfe4b66c9a62ffd93998314ce27e9586
DanaBot
637d8c2a652b364d37a2d184e9e04ad252353370c9c1cb987410e6030dbdd5ae
DanaBot
889e79039dd2255f30d5e5244306b2b3c7108a4696478a4aeb6c9f3cc792b543
DanaBot
99df8e49e514931ebc8df66ca8fe265f80b2f9c09ce7b3e00a998c7db941a3c3
DanaBot
9c1060f235f5c568ca7461ead6d60926d416d18451b755efd3ab1465681e9d80
DanaBot
f66a32559056cd11d34d31ac48a4488de144daa4825d7292e85436601a177434
DanaBot
+ 5'904 additional samples on MalwareBazaar
Result
Malware family:
danabot
Create hunting rule
Score:
  10/10
Tags:
family:danabot banker trojan
Link:
https://tria.ge/reports/211003-jczsdsfcam/
Behaviour
Suspicious use of WriteProcessMemory
Loads dropped DLL
Blocklisted process makes network request
Danabot
Danabot Loader Component
Malware Config
C2 Extraction:
142.11.192.232:443
192.119.110.73:443
142.11.242.31:443
192.210.222.88:443
Unpacked files
SH256 hash:
e09337ba33bb3612597125fb8ebf7a351901f55152cd9ce6860ebad41d4eaa9b
MD5 hash:
e2b983c379e315ab51c35ca646806d03
SHA1 hash:
80b65a22171d179cc2318f68070fa81cf140ea84
Link:
https://www.unpac.me/results/d3117f46-9cb7-4f10-833e-751bbd516b35/
SH256 hash:
7bf417d7e53e244e86dc2fbecf87bd83df45669b766c3cd579dcd07533065dce
MD5 hash:
9a32f87608f3464b2dfff627438c4429
SHA1 hash:
5dfd27ef29c3af291bbf8f4a1025563b3d940507
Link:
https://www.unpac.me/results/d3117f46-9cb7-4f10-833e-751bbd516b35/
SH256 hash:
5d48b2614aaaebab4a97deafbd3117e2baa62aaf6a357003b10554e3caa60f5a
MD5 hash:
2bce3c8efb3cb62fe2537ba2ff92030a
SHA1 hash:
426d0806320d005938fc7c698291bd6b9cca46ea
Link:
https://www.unpac.me/results/d3117f46-9cb7-4f10-833e-751bbd516b35/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5d48b2614aaaebab4a97deafbd3117e2baa62aaf6a357003b10554e3caa60f5a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DanaBot

Executable exe 5d48b2614aaaebab4a97deafbd3117e2baa62aaf6a357003b10554e3caa60f5a

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1640605/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/194312/

Comments