MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6881828efde486122c37efd3d20ad30300f747ac1ad2bcaf2be62ef7d8add52c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DanaBot


Vendor detections: 13


Intelligence 13 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6881828efde486122c37efd3d20ad30300f747ac1ad2bcaf2be62ef7d8add52c
SHA3-384 hash: fae1f8f20ea7471ac29d21b7ffff1f3517451e32d85cf95a29a1f8cc8c467aec63b4a1fd6811cf756c49b6d4fe3ce37c
SHA1 hash: a92e9f24859e55ad59d73b833a1142a8dec299de
MD5 hash: 7aaac014118ba6b6391bc2b52d2790da
humanhash: item-dakota-sink-neptune
File name:7aaac014118ba6b6391bc2b52d2790da.exe
Download: download sample
Signature DanaBot
Create hunting rule
File size:2'788'352 bytes
First seen:2023-03-17 19:01:54 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 48e7bdebf7b90ec755513d967cfa38a8 (2 x Stealc, 2 x Smoke Loader, 1 x TeamBot)
ssdeep 49152:Y+t8Il2Zp5WvMMq1QlnpKrWeHqAiRevstycpjM7kXbUepVc:Y+trl2ZrVMq162IaKAoIU
Threatray 55 similar samples on MalwareBazaar
TLSH T153D52253C6A07C44EA168A7B6E1FCBE8621EF560CF4A77F61219DE2F05B11B2C163712
TrID 37.3% (.EXE) Win64 Executable (generic) (10523/12/4)
17.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
16.0% (.EXE) Win32 Executable (generic) (4505/5/1)
7.3% (.ICL) Windows Icons Library (generic) (2059/9)
7.2% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon 2880801400902000 (1 x DanaBot)
Reporter abuse_ch
Tags:DanaBot exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
263
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
danabot
Create hunting rule
ID:
1
File name:
7aaac014118ba6b6391bc2b52d2790da.exe
Verdict:
Malicious activity
Analysis date:
2023-03-17 19:05:59 UTC
Tags:
danabot
Link:
https://app.any.run/tasks/5159f4cf-fc8b-48a3-acfb-710f689a54bb

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/375211/
Detection(s):
Win.Packer.pkr_ce1a-9980177-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Creating a window
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Sending a custom TCP request
Sending an HTTP GET request
Searching for the window
Changing a file
Сreating synchronization primitives
Unauthorized injection to a system process
Result
Malware family:
n/a
Score:
  9/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/73663/overview
Behaviour
MalwareBazaar
MeasuringTime
SystemUptime
CPUID_Instruction
EvasionGetTickCount
CheckCmdLine
EvasionQueryPerformanceCounter
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
gandcrab gozi greyware lockbit packed upatre
Link:
https://www.filescan.io/uploads/6414b92bc60b3295f52b9908/reports/12b28e5f-8dbd-4ffc-8420-a5b0d68baa90/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/6881828efde486122c37efd3d20ad30300f747ac1ad2bcaf2be62ef7d8add52c
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
DanaBot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e2832648-deb7-49df-b0b0-782ed903c331
Result
Threat name:
DanaBot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/1196223
Signature
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Yara detected DanaBot stealer dll
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6881828efde486122c37efd3d20ad30300f747ac1ad2bcaf2be62ef7d8add52c/
Threat name:
Win32.Trojan.SmokeLoader
Create hunting rule
Status:
Malicious
First seen:
2023-03-17 18:28:26 UTC
File Type:
PE (Exe)
Extracted files:
62
AV detection:
19 of 24 (79.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ncayfdx54sdbelbx57j5ecwtamapor5mdljlzlzl4yxppwfn2uwa._file
Verdict:
malicious
Similar samples:
1f984f06dd4dba858766fd2e8d81877e9738f8b9dc6706ce69b7b6e596c466d6
DanaBot
3af27ce24861a032e7437eaf39c59930c950dd1aabb371c1e9c0ff4bbbd0ae0f
DanaBot
4e92875fda924c97345692089644a87181ea46401d8249639f30eff2970d4f45
DanaBot
51c7f3e3637dfe07b6b51c46947926a2b6b44dcc81c7d6f783c94b49f2b12113
DanaBot
5bf63fb0014e66cda124ae8d9a2275e8a1c98704e8885c4aadadf74fdb162920
DanaBot
5daeae2494873409b8b59fd1adde883ce972d9a1d9616ce7d9067aaa3527ed7f
DanaBot
8f6df7df63e769169784c8909e9138c0aa632cc23a24ecb61496fa152230ae07
DanaBot
9b6cf78552cbf1c9f7a20b73c7c3f98a6d894ecc40331b82b6ca1f42ae5dc672
DanaBot
ca004f3971c503ecb459840848612bd0614b7b40af5ca8616c8936eb075686f6
DanaBot
cce420c482906f27b8001849e8a02daacd04a1eb4fd59ba2d9fe68626e3b4270
DanaBot
+ 45 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/230317-xpr5zahf55/
Behaviour
Checks processor information in registry
Modifies registry class
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of SetThreadContext
Loads dropped DLL
Blocklisted process makes network request
Unpacked files
SH256 hash:
ea64ce6bdd589bcacbdfdae81a59a7b8273a8b313148e8682397b0c018caeada
MD5 hash:
8630fd0071991daf54f48c7e2e65724f
SHA1 hash:
29eb919e15b7bdfbafd0d9fa05abfd8fd6ff5c0a
Link:
https://www.unpac.me/results/37d3b59d-0aa6-43ec-9215-447b8031f8bc/
SH256 hash:
c04615d5d748632c2e88605946ff13b09e7773e4f35c38a84cc25371fd3f30f9
MD5 hash:
2f5e46d625bc36870c26d17f52505d72
SHA1 hash:
d37db44250ba81533d97f3316ab1a9b5b6fc5051
Link:
https://www.unpac.me/results/37d3b59d-0aa6-43ec-9215-447b8031f8bc/
SH256 hash:
6881828efde486122c37efd3d20ad30300f747ac1ad2bcaf2be62ef7d8add52c
MD5 hash:
7aaac014118ba6b6391bc2b52d2790da
SHA1 hash:
a92e9f24859e55ad59d73b833a1142a8dec299de
Link:
https://www.unpac.me/results/37d3b59d-0aa6-43ec-9215-447b8031f8bc/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/6881828efde4/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6881828efde486122c37efd3d20ad30300f747ac1ad2bcaf2be62ef7d8add52c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Windows_Trojan_Smokeloader_3687686f
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DanaBot

Executable exe 6881828efde486122c37efd3d20ad30300f747ac1ad2bcaf2be62ef7d8add52c

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2567670/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/375211/

Comments