MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 716e5a3d29ff525aed30c18061daff4b496f3f828ba2ac763efd857062a42e96. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DanaBot


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 716e5a3d29ff525aed30c18061daff4b496f3f828ba2ac763efd857062a42e96
SHA3-384 hash: 08dd0c53b6482de4e68615f4d672c01d8813de72b073face80a06f1213038ce548cfd7d11c8a76163f13d93118cfe073
SHA1 hash: 5baa7a03331596f073b7ec03c72e8812d51f2cb3
MD5 hash: c00d207efb855910154389b48404e550
humanhash: oranges-moon-item-fix
File name:cNjqsBS.bin
Download: download sample
Signature DanaBot
Create hunting rule
File size:1'390'592 bytes
First seen:2021-08-13 01:30:46 UTC
Last seen:2021-08-13 06:47:22 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 5f64f70cee34af5497ae02dd3fd387b7 (5 x DanaBot)
ssdeep 24576:qcFPyLyEv4NeAXD+Rk+p736lDEU4KgTfp:RQa+lKlDJgT
Threatray 3'835 similar samples on MalwareBazaar
TLSH T128556E22B249E53EC0EB0A3A4566F584483FB67167658C1F57E019CCDF2DA801A39F6F
Reporter malware_traffic
Tags:DanaBot dll

Intelligence

File Origin
# of uploads :
3
# of downloads :
381
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/178809/
Detection(s):
SecuriteInfo.com.Trojan.Siggen14.60163.24166.5791.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Connection attempt
Sending a custom TCP request
Sending a UDP request
Creating a file in the Program Files directory
Launching a process
Creating a file
Adding a root certificate
Setting a new proxy server as a default one
Enabling the use of the proxy server
Creating a window
Reading critical registry keys
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a process with a hidden window
Using the Windows Management Instrumentation requests
Searching for the window
DNS request
Deleting a recently created file
Stealing user critical data
Unauthorized injection to a system process
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
DanaBot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f0ce942e-4441-473b-9c8a-df481c9d28ff
Result
Threat name:
Unknown
Detection:
malicious
Classification:
bank.adwa.spyw.evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/832108
Signature
Bypasses PowerShell execution policy
Enables a proxy for the internet explorer
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sets a proxy for the internet explorer
Sigma detected: Suspicious Script Execution From Temp Folder
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal browser information (history, passwords, etc)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 464539 Sample: cNjqsBS.bin Startdate: 13/08/2021 Architecture: WINDOWS Score: 80 45 localhost 2->45 47 8.8.8.8.in-addr.arpa 2->47 55 Multi AV Scanner detection for submitted file 2->55 57 Sigma detected: Suspicious Script Execution From Temp Folder 2->57 10 loaddll32.exe 2 2->10         started        signatures3 process4 process5 12 rundll32.exe 2 10->12         started        16 rundll32.exe 1 10->16         started        18 rundll32.exe 1 10->18         started        20 4 other processes 10->20 dnsIp6 53 192.52.167.44, 443, 49729, 49730 ASN-QUADRANET-GLOBALUS United States 12->53 67 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 12->67 69 Bypasses PowerShell execution policy 12->69 22 rundll32.exe 10 23 12->22         started        27 WerFault.exe 16->27         started        29 rundll32.exe 18->29         started        31 rundll32.exe 1 20->31         started        33 WerFault.exe 20->33         started        signatures7 process8 dnsIp9 49 127.0.0.1 unknown unknown 22->49 43 C:\Users\user\AppData\...\tmp6788.tmp.ps1, ASCII 22->43 dropped 59 System process connects to network (likely due to code injection or exploit) 22->59 61 Tries to harvest and steal browser information (history, passwords, etc) 22->61 63 Sets a proxy for the internet explorer 22->63 65 Enables a proxy for the internet explorer 22->65 35 powershell.exe 22->35         started        37 powershell.exe 22->37         started        51 192.168.2.1 unknown unknown 27->51 file10 signatures11 process12 process13 39 conhost.exe 35->39         started        41 conhost.exe 37->41         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/716e5a3d29ff525aed30c18061daff4b496f3f828ba2ac763efd857062a42e96/
Threat name:
Win32.Trojan.DanaBot
Create hunting rule
Status:
Malicious
First seen:
2021-08-12 18:35:51 UTC
File Type:
PE (Dll)
AV detection:
21 of 47 (44.68%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
053542bbd9ab3b0436469e6d6ae5ff0b72e55f882a08e23d8ab481e1357d9528
DanaBot
23d57a913a8c60630d1f26d5f7eba55d8437d7595f562b1dd81b2ebc8d69751c
DanaBot
58dd074be5e51ca44f0c67ed712b3bb7a1afe1723adccdf3491636fef7cf1a2d
DanaBot
68ebca16a59d6ddc022472a4c4d68f8f6491c70737fddf1723ef36f11d8eb043
DanaBot
750e38bbaba907ed33434c5a10119773f1d73dba4d6c624d16bc1bc2dfacac46
DanaBot
967e08d85b9639892fd4bf4ab2d3e6fc7dcd4afe22326e4114df182c8b0a9b5e
DanaBot
b201c8657c45c97a017d357f7542d2786fac1e9cde1a4ce8c5c2021f52e83540
DanaBot
c252d146aa7c269b0db0a7c05f094da93234e6ace6ad52bd33860edd4127b6eb
DanaBot
e83e6702c3b59f275981161db3eabdb589051a4d36ad2d74c34a8fc45cb31a30
DanaBot
f5fe7311025d620bccb08dcfb69f03c71620351b35ea8635b798ffc62374423a
DanaBot
+ 3'825 additional samples on MalwareBazaar
Result
Malware family:
danabot
Create hunting rule
Score:
  10/10
Tags:
family:danabot banker discovery spyware stealer trojan
Link:
https://tria.ge/reports/210813-aa9188tlf6/
Behaviour
Checks processor information in registry
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Checks installed software on the system
Reads user/profile data of web browsers
Blocklisted process makes network request
Danabot
Danabot Loader Component
Unpacked files
SH256 hash:
716e5a3d29ff525aed30c18061daff4b496f3f828ba2ac763efd857062a42e96
MD5 hash:
c00d207efb855910154389b48404e550
SHA1 hash:
5baa7a03331596f073b7ec03c72e8812d51f2cb3
Link:
https://www.unpac.me/results/67df27bf-d29f-4172-9ceb-201d04ec27e4/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/716e5a3d29ff525aed30c18061daff4b496f3f828ba2ac763efd857062a42e96

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DanaBot

DLL dll 716e5a3d29ff525aed30c18061daff4b496f3f828ba2ac763efd857062a42e96

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/178809/
  
URLhaus
https://urlhaus.abuse.ch/url/1529729/
  
Delivery method
Distributed via web download

Comments