MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 637d8c2a652b364d37a2d184e9e04ad252353370c9c1cb987410e6030dbdd5ae. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
DanaBot
Vendor detections: 8
| SHA256 hash: | 637d8c2a652b364d37a2d184e9e04ad252353370c9c1cb987410e6030dbdd5ae |
|---|---|
| SHA3-384 hash: | cd1bcb5addf7557a20f458a6a0c280852e5b6916510c8b3d7328506c5b38927fe8ed146dd02c108d5d49913fbeb388f3 |
| SHA1 hash: | 85e269e644076c4c6577f2a8d847c3ca74d11147 |
| MD5 hash: | ddde0c7bd614d95d6cec4d2ff4837556 |
| humanhash: | mississippi-fruit-magazine-florida |
| File name: | ddde0c7bd614d95d6cec4d2ff4837556 |
| Download: | download sample |
| Signature | DanaBot |
| File size: | 1'066'496 bytes |
| First seen: | 2021-09-23 12:36:29 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f7987bf55fcab080da60dcb9686a7f63 (9 x RedLineStealer, 3 x RaccoonStealer, 2 x Tofsee) |
| ssdeep | 12288:HRI45SISBdX1vSsPFlDFiJvE0lXWN7wGaR8+trQRVh4M6iEEfRQJrzGy9vt81SYv:x3Ad3lBPPFigFEFrQRVh2iE6QlVi1d |
| Threatray | 5'654 similar samples on MalwareBazaar |
| TLSH | T14835238215F1C037F6272EF0CDF5D1988AFEB863A4B5586A37C526A64F613C1D9A8313 |
| File icon (PE): |  |
| dhash icon | 1072c293b0381906 (17 x RedLineStealer, 5 x Stop, 4 x DanaBot) |
| Reporter |  zbetcheckin |
| Tags: | 32 DanaBot exe |
Intelligence
File Origin
# of uploads :
1
# of downloads :
260
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
ddde0c7bd614d95d6cec4d2ff4837556
Verdict:
Malicious activity
Analysis date:
2021-09-23 12:37:20 UTC
Tags:
trojan danabot
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
DanaBot
Malware family:
Generic Malware
Verdict:
Malicious
Result
Threat name:
DanaBot
Detection:
malicious
Classification:
troj.evad
Score:
96 / 100
Signature
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Yara detected DanaBot stealer dll
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Racealer
Status:
Malicious
First seen:
2021-09-23 12:37:09 UTC
AV detection:
18 of 28 (64.29%)
Threat level:
5/5
Verdict:
malicious
Similar samples:
+ 5'644 additional samples on MalwareBazaar
Gathering data
Unpacked files
SH256 hash:
680d96391fcd6b5b085fc389da9a933d2cf41a8bf9c71c4c711ccf660b8f94e2
MD5 hash:
baf2a8eb922dc82fa691ebb99786d4d3
SHA1 hash:
9bb5b28df8a7ad9b40bb6aeb1db53ad0315639f3
SH256 hash:
1e3d23f51d645491ee1b9d0330e7e518d5f2e8fb1d43fd85b2cce890a5f7420f
MD5 hash:
76a1c75e53720bc07add51d432b0abba
SHA1 hash:
edc4c9cb04aa23313c9bcba65924d9f312518948
SH256 hash:
637d8c2a652b364d37a2d184e9e04ad252353370c9c1cb987410e6030dbdd5ae
MD5 hash:
ddde0c7bd614d95d6cec4d2ff4837556
SHA1 hash:
85e269e644076c4c6577f2a8d847c3ca74d11147
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.url : hxxp://78.142.29.121/root.exe