🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5e5b42ac0cb3163dd4d87a9fd92bc4ec47dcb23ba829df540448d793ecea5fbc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DanaBot


Vendor detections: 12


Intelligence 12 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5e5b42ac0cb3163dd4d87a9fd92bc4ec47dcb23ba829df540448d793ecea5fbc
SHA3-384 hash: c05d3dc63447620db04038b7245a44a703805b459cc2593625686fe928b474ca24824205e917432f3dd24e8b5cc11b75
SHA1 hash: 562d5ff478b66d593bb4a49e290565be9dbee808
MD5 hash: 50afb496cec91682987c87bc9b4cad4d
humanhash: magazine-diet-blue-victor
File name:Trojan-Banker.Win32.Danabot.jsz-5e5b42ac0cb31.dll
Download: download sample
Signature DanaBot
Create hunting rule
File size:1'419'264 bytes
First seen:2023-11-16 04:20:08 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash f9e81afd2870aaecd8ace36b2893b1d3 (10 x DanaBot)
ssdeep 24576:4u9eawqFvymPU8ChCNQVw8+6SgImw2qX0TaLrS:RE0ilVwf9mFqX0T
Threatray 1 similar samples on MalwareBazaar
TLSH T1DC656E22B248A57EC4FA0A3A4627654C553F77327A558C1E5BE009CCCF392C16A3677F
TrID 58.3% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9)
14.7% (.EXE) Win64 Executable (generic) (10523/12/4)
9.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.9% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Reporter abuse_ch
Tags:DanaBot dll


Avatar
abuse_ch
DanaBot C2:
142.11.242.31:443

Intelligence

File Origin
# of uploads :
1
# of downloads :
378
Origin country :
NL NL
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/458794/
Detection(s):
SecuriteInfo.com.Trojan.Siggen15.17502.20079.31903.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Sending a custom TCP request
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-vm danabot danabot extrac32 finger fingerprint ieexec lolbin msbuild msiexec runonce stealer
Link:
https://www.filescan.io/uploads/655598af10294cf873d15b20/reports/0284670e-6f16-45f9-bc5b-a1254ae4d375/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/5e5b42ac0cb3163dd4d87a9fd92bc4ec47dcb23ba829df540448d793ecea5fbc
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/38c0a524-cfda-43b2-9d25-194c3e9c90c6
Result
Threat name:
DanaBot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1343406
Signature
Antivirus / Scanner detection for submitted sample
C2 URLs / IPs found in malware configuration
Found malware configuration
Found potential dummy code loops (likely to delay analysis)
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Yara detected DanaBot stealer dll
Behaviour
Behavior Graph:
Download SVG
Score:
87%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/5e5b42ac0cb3163dd4d87a9fd92bc4ec47dcb23ba829df540448d793ecea5fbc
Detection:
danabot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/5e5b42ac0cb3163dd4d87a9fd92bc4ec47dcb23ba829df540448d793ecea5fbc/
Threat name:
Win32.Trojan.DanaBot
Create hunting rule
Status:
Malicious
First seen:
2021-10-09 22:58:51 UTC
File Type:
PE (Dll)
AV detection:
25 of 38 (65.79%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lznuflamwmld3vgypkp5sk6e5rd5zmr3vau56vaejdlzh3hkl66a._file
Verdict:
malicious
Similar samples:
5e5b42ac0cb3163dd4d87a9fd92bc4ec47dcb23ba829df540448d793ecea5fbc
DanaBot
Result
Malware family:
danabot
Create hunting rule
Score:
  10/10
Tags:
family:danabot botnet:4 banker trojan
Link:
https://tria.ge/reports/231116-eym89sgg6t/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Blocklisted process makes network request
Danabot
Danabot Loader Component
Malware Config
C2 Extraction:
142.11.242.31:443
192.119.110.73:443
192.210.222.88:443
Unpacked files
SH256 hash:
6f769050debd2cf6ccec3b53f3fcc88189c534076f145fc1e4fd802f3003e2b1
MD5 hash:
c8e8f5a8fa01c64f8c7a75aa29f261c4
SHA1 hash:
b4bc6478ace1a9ee54e47a6737f20735443838f1
Link:
https://www.unpac.me/results/d87e0253-964b-427c-a483-00ad880def5b/
SH256 hash:
5e5b42ac0cb3163dd4d87a9fd92bc4ec47dcb23ba829df540448d793ecea5fbc
MD5 hash:
50afb496cec91682987c87bc9b4cad4d
SHA1 hash:
562d5ff478b66d593bb4a49e290565be9dbee808
Link:
https://www.unpac.me/results/d87e0253-964b-427c-a483-00ad880def5b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5e5b42ac0cb3163dd4d87a9fd92bc4ec47dcb23ba829df540448d793ecea5fbc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/458794/

Comments