MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 611cad21a5fd2a344b7c6b45a78ac771df952c267812f894707d35fce0c59b13. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SchoolBoy

Vendor detections: 14

Intelligence 14 IOCs YARA 28 File information Comments

SHA256 hash:	611cad21a5fd2a344b7c6b45a78ac771df952c267812f894707d35fce0c59b13
SHA3-384 hash:	d5403874c8b401f222cbadd65e49e06064c1c9d7f4076fafe93284b44792557950c6dc3e1b46ea8d8c00f12d4aad76e1
SHA1 hash:	27cff220f1dc0306be31bcba3bb2cb70357461cb
MD5 hash:	b46533ee942425c732bf376b34d1eadf
humanhash:	quiet-mango-fish-jersey
File name:	611cad21a5fd2a344b7c6b45a78ac771df952c267812f894707d35fce0c59b13
Download:	download sample
Signature	SchoolBoy Create hunting rule
File size:	4'044'800 bytes
First seen:	2023-11-09 20:35:41 UTC
Last seen:	2023-11-09 22:25:16 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	dafc225eed638e21ac8d84afad5d916b (1 x SchoolBoy)
ssdeep	49152:7ayH8UOV1AWjIBCefgCs6Xaxp0M9RDFDW/7jhhTzvQkw7HeP5hz9sNiiQXiyliTa:7dOVVIBrs6upzpSxRzYNHePLxjbyyoaZ
Threatray	75 similar samples on MalwareBazaar
TLSH	T16116E122F248663ED4FE2A3A4463B550D93F7761A816DC9B4BE40849CF359816B3F18F
TrID	58.3% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9) 14.7% (.EXE) Win64 Executable (generic) (10523/12/4) 9.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.3% (.EXE) Win32 Executable (generic) (4505/5/1) 2.9% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Reporter	Anonymous
Tags:	exe SchoolBoy

Intelligence

File Origin

# of uploads :

# of downloads :

282

Origin country :

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Win32.SpywareX-gen.27523.20417.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Changing a file

Creating a file

Modifying an executable file

Сreating synchronization primitives

Launching a process

Creating a process with a hidden window

Creating a window

Searching for synchronization primitives

Sending a custom TCP request

Creating a service

Modifying a system file

Launching a service

Restart of the analyzed sample

Adding a root certificate

Setting a new proxy server as a default one

Enabling the use of the proxy server

Creating a file in the %AppData% subdirectories

Creating a file in the %temp% directory

Sending a UDP request

Creating a process from a recently created file

Enabling autorun for a service

Infecting executable files

Unauthorized injection to a system process

Adding an exclusion to Microsoft Defender

Gathering data

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

danabot packed

Link:

https://www.filescan.io/uploads/654d42b6946b6ab2245cf94b/reports/6a344bae-b257-4df2-aa4c-3ebb721ca2ab/overview

Verdict:

Malicious

Labled as:

Barys.Generic

Link:

https://www.hybrid-analysis.com/sample/611cad21a5fd2a344b7c6b45a78ac771df952c267812f894707d35fce0c59b13

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

DanaBot

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/b4e6ded5-33c8-4930-9e61-ca605460d615

Result

Threat name:

DanaBot

Detection:

malicious

Classification:

troj.evad

Score:

80 / 100

Link:

https://www.joesandbox.com/analysis/1339992

Signature

Antivirus / Scanner detection for submitted sample

Machine Learning detection for sample

May use the Tor software to hide its network traffic

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Yara detected DanaBot stealer dll

Behaviour

Behavior Graph:

Download SVG

Score:

87%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/611cad21a5fd2a344b7c6b45a78ac771df952c267812f894707d35fce0c59b13

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/611cad21a5fd2a344b7c6b45a78ac771df952c267812f894707d35fce0c59b13/

Threat name:

Win32.Trojan.DanaBot

Status:

Malicious

First seen:

2023-11-03 01:27:00 UTC

File Type:

PE (Exe)

AV detection:

24 of 38 (63.16%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=meok2inf7uvdis34nnc2pcwhohpzklbgpajprfdqpu27zygftmjq._file

Verdict:

malicious

SchoolBoy

4f0925a84a5c9624ef8f734239ee56188ba9341d48dc0f07db902e59743a4590

SchoolBoy

611cad21a5fd2a344b7c6b45a78ac771df952c267812f894707d35fce0c59b13

SchoolBoy

6d0d0bfb0234dfe8b53845a003af0e8dc32f3be55a93a5a0ac7850f24c6df80a

SchoolBoy

76036d4aabf28f8a735919c2f9fccf8c4290dd41ff7ebb5d25d08f1278b240bb

SchoolBoy

804a0999f1e0c5a8e083f0a36ccfe7ad8a6ab94a0c77d6ab74175540c990f95e

SchoolBoy

b23e219ee4998ff38b9d571f5a4ff3bf7702d509bce4c910708b3d78956367c1

SchoolBoy

f57dab60885da9213f24b4896129182cb29ad3bd7be194685b68d61e6357188b

SchoolBoy

+ 65 additional samples on MalwareBazaar

Result

Malware family:

danabot

Score:

10/10

Tags:

family:danabot banker trojan

Link:

https://tria.ge/reports/231109-zdj2bsde4s/

Behaviour

Checks processor information in registry

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Suspicious use of SetThreadContext

Blocklisted process makes network request

Danabot

Unpacked files

SH256 hash:

12ed10f754d6f237978d549164b0de969287ce54198adf2e3958038063cd0fe6

MD5 hash:

c141e2ddbc1363d94b09ee50825c19e9

SHA1 hash:

be4bf40fb828b3a250df58406444702fc3033bd3

Detections:

win_sinowal_w1

Link:

https://www.unpac.me/results/ffa7ef9d-a99e-45ad-b642-922899d617c8/

SH256 hash:

611cad21a5fd2a344b7c6b45a78ac771df952c267812f894707d35fce0c59b13

MD5 hash:

b46533ee942425c732bf376b34d1eadf

SHA1 hash:

27cff220f1dc0306be31bcba3bb2cb70357461cb

Link:

https://www.unpac.me/results/ffa7ef9d-a99e-45ad-b642-922899d617c8/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/611cad21a5fd2a344b7c6b45a78ac771df952c267812f894707d35fce0c59b13

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	adonunix2 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	AD on UNIX

Rule name:	BLOWFISH_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for Blowfish constants

Rule name:	BobSoftMiniDelphiBoBBobSoft Create hunting rule
Author:	malware-lu

Rule name:	Borland Create hunting rule
Author:	malware-lu

Rule name:	Check_OutputDebugStringA_iat Create hunting rule

Rule name:	command_and_control Create hunting rule
Author:	CD_R0M_
Description:	This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	HeavensGate Create hunting rule
Author:	kevoreilly
Description:	Heaven's Gate: Switch from 32-bit to 64-mode

Rule name:	html_auto_download_b64 Create hunting rule
Author:	Tdawg
Description:	html auto download

Rule name:	maldoc_find_kernel32_base_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	maldoc_getEIP_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	meth_get_eip Create hunting rule
Author:	Willi Ballenthin

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	QbotStuff Create hunting rule
Author:	anonymous

Rule name:	Quarian Create hunting rule
Author:	Seth Hardy
Description:	Quarian

Rule name:	QuarianCode Create hunting rule
Author:	Seth Hardy
Description:	Quarian code features

Rule name:	RC6_Constants Create hunting rule
Author:	chort (@chort0)
Description:	Look for RC6 magic constants in binary
Reference:	https://twitter.com/mikko/status/417620511397400576

Rule name:	reverse_http Create hunting rule
Author:	CD_R0M_
Description:	Identify strings with http reversed (ptth)

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	SHA512_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA384/SHA512 constants

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	WHIRLPOOL_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for WhirlPool constants

Rule name:	win_sinowal_w1 Create hunting rule
Author:	Seth Hardy
Description:	Quarian code features

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample