MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6777ebe2c39e27f0bee03860b02a8ac080e3ab98375d933d6bb4ca792cc046ba. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

DanaBot

Vendor detections: 12

Intelligence 12 IOCs YARA 1 File information Comments 1

SHA256 hash:	6777ebe2c39e27f0bee03860b02a8ac080e3ab98375d933d6bb4ca792cc046ba
SHA3-384 hash:	3a233c3ac52d5957fb99e3ff4484e41923030c52d33ee34f86b881ffc82913e56e09957221190c0403622e0f7b92f9a0
SHA1 hash:	cf0ca250948d9da9278c882903a74cdc4bdbdd3f
MD5 hash:	8c735fa907ed1b1a7f6251e231a408c5
humanhash:	moon-summer-mountain-london
File name:	8c735fa907ed1b1a7f6251e231a408c5
Download:	download sample
Signature	DanaBot Create hunting rule
File size:	1'763'840 bytes
First seen:	2021-12-17 09:12:58 UTC
Last seen:	2021-12-17 10:58:48 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	44c00401a20ce3d35e55418765dd0985 (4 x RedLineStealer, 2 x DanaBot)
ssdeep	49152:iaywtfx/FSFBlkYw27nsTWuxda375UjlI:EM/FSFoY5sTfxdarSl
TLSH	T1C6852334B4DAD272C7B798359BB0C7D64A6ABC106B01915B3718169D1B22FEC8EC634F
File icon (PE):
dhash icon	4839b234e8c38890 (121 x RaccoonStealer, 54 x RedLineStealer, 51 x ArkeiStealer)
Reporter	zbetcheckin
Tags:	32 DanaBot exe

Intelligence

File Origin

# of uploads :

# of downloads :

455

Origin country :

n/a

Vendor Threat Intelligence

Detection:

DanaBot

Link:

https://www.capesandbox.com/analysis/214754/

Detection(s):

SecuriteInfo.com.W32.AIDetect.malware1.508.21922.UNOFFICIAL

Result

Verdict:

Suspicious

Maliciousness:

Behaviour

Searching for the window

Creating a file

Enabling the 'hidden' option for recently created files

DNS request

Launching a process

Creating a process with a hidden window

Result

Malware family:

n/a

Score:

9/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/2359/overview

Behaviour

MalwareBazaar

CPUID_Instruction

MeasuringTime

SystemUptime

EvasionQueryPerformanceCounter

EvasionGetTickCount

CheckCmdLine

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

greyware packed

Link:

https://www.filescan.io/uploads/61bc54ca8541392eb4ebf332/reports/a6574cd2-33f1-4c34-93b1-56045559749e/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Generic Malware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/73cf8cc6-4305-4fa0-acb8-214eef224fc3

Result

Threat name:

DanaBot

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/908972

Signature

C2 URLs / IPs found in malware configuration

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Machine Learning detection for dropped file

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Yara detected DanaBot stealer dll

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6777ebe2c39e27f0bee03860b02a8ac080e3ab98375d933d6bb4ca792cc046ba/

Threat name:

Win32.Ransomware.StopCrypt

Status:

Malicious

First seen:

2021-12-17 09:27:35 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

24 of 28 (85.71%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=m536xywdtyt7bpxahbqlakukycaohk4yg5ozgpllwtfhslgai25a._file

Verdict:

malicious

Result

Malware family:

danabot

Score:

10/10

Tags:

family:danabot botnet:4 banker trojan

Link:

https://tria.ge/reports/211217-k6ymvsebcm/

Behaviour

Suspicious use of WriteProcessMemory

Loads dropped DLL

Danabot

Danabot Loader Component

Malware Config

C2 Extraction:

142.11.244.223:443
23.106.122.139:443

Unpacked files

SH256 hash:

d796899c0a728cab0b5550c0c353ee97d9ee90cacdc163a23b2c1c1d4e2ebdf9

MD5 hash:

c694f87ef5ff85c946b89ba8f0c35e78

SHA1 hash:

d70af067aa2875c9b661aac2a1f7636cf2f50cda

Link:

https://www.unpac.me/results/06ffe892-5615-4b5a-8d20-b74046d2c1cd/

SH256 hash:

197a404d368f5f76af0912255f043f076cb38ab05df3a7a3882740b1843be4fa

MD5 hash:

1f4a7aaacaae1aeeb1ca76e63623c41c

SHA1 hash:

b8b5576cd9ff00a58fb3f578d37b477c30e6cb9d

Link:

https://www.unpac.me/results/06ffe892-5615-4b5a-8d20-b74046d2c1cd/

SH256 hash:

6777ebe2c39e27f0bee03860b02a8ac080e3ab98375d933d6bb4ca792cc046ba

MD5 hash:

8c735fa907ed1b1a7f6251e231a408c5

SHA1 hash:

cf0ca250948d9da9278c882903a74cdc4bdbdd3f

Link:

https://www.unpac.me/results/06ffe892-5615-4b5a-8d20-b74046d2c1cd/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/6777ebe2c39e27f0bee03860b02a8ac080e3ab98375d933d6bb4ca792cc046ba

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.