MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 69e0603bc5aabcf9ed60c2ed34e96b5464fc13c89585fb7478aa053aed3f0138. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

DanaBot

Vendor detections: 4

Intelligence 4 IOCs YARA File information Comments

SHA256 hash:	69e0603bc5aabcf9ed60c2ed34e96b5464fc13c89585fb7478aa053aed3f0138
SHA3-384 hash:	38cc0a231d97dde21af0ed3fb09f8871fc4ae51f9157ec59531dfba90a58cf02d4c536da4eed5797f7a133a53b407401
SHA1 hash:	d5c2168845918ec63056ded0664d5b3a4891b14b
MD5 hash:	fc6c2250c3b97d7f45aa288929a015b6
humanhash:	wisconsin-equal-tennis-apart
File name:	filemy.exe
Download:	download sample
Signature	DanaBot Create hunting rule
File size:	971'264 bytes
First seen:	2020-04-30 10:44:57 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	abbd29e9620cefd8f8045cd35d3a32f2 (1 x DanaBot)
ssdeep	24576:fuPsQeujCcrnZgu6PRfRB0yLlWHiyuq6MBrErtckZItB+:p0/nZguqRB0wlWfVtIrZZk+
Threatray	42 similar samples on MalwareBazaar
TLSH	9F2512A277B0F832E2625E3099A7D712097579056A3C554FA7FC0E7E1F2C7D04BAA306
Reporter	JoulK
Tags:	DanaBot exe

Intelligence

File Origin

# of uploads :

# of downloads :

766

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Generic.mg.fc6c2250c3b97d7f.22632.UNOFFICIAL

PUA.Win.Downloader.Aiis-6803892-0

Gathering data

Threat name:

Win32.Trojan.Danabot

Status:

Malicious

First seen:

2020-04-30 10:22:04 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

25 of 31 (80.65%)

Threat level:

2/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=nhqgao6fvk6pt3laylwtj2llkrspye6iswc7w5dyvictv3j7ae4a._file

Verdict:

malicious

Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DanaBot

exe 69e0603bc5aabcf9ed60c2ed34e96b5464fc13c89585fb7478aa053aed3f0138

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/354587/

Delivery method

Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::CloseHandle
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::DeleteVolumeMountPointW KERNEL32.dll::FindFirstVolumeMountPointA KERNEL32.dll::LoadLibraryW KERNEL32.dll::GetVolumeInformationA KERNEL32.dll::GetStartupInfoW
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::WriteConsoleOutputCharacterW KERNEL32.dll::WriteConsoleW KERNEL32.dll::SetConsoleOutputCP KERNEL32.dll::SetConsoleScreenBufferSize KERNEL32.dll::SetConsoleWindowInfo KERNEL32.dll::SetStdHandle
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CreateFileW KERNEL32.dll::GetWindowsDirectoryA KERNEL32.dll::SetVolumeMountPointA
WIN_SVC_API	Can Manipulate Windows Services	ADVAPI32.dll::QueryServiceLockStatusA

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample