MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 7277ba54308bcc7098ac8be7c268a99edce0dbd0b49536b36acca25ca06b5de6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
DanaBot
Vendor detections: 8
| SHA256 hash: | 7277ba54308bcc7098ac8be7c268a99edce0dbd0b49536b36acca25ca06b5de6 |
|---|---|
| SHA3-384 hash: | 61b1976596c47997f600c8fc95cb471b40ce16f35bb016d1906b5ca78cccdc57290d570155ea666d1a611488f4618c8f |
| SHA1 hash: | fb3b8701c0dfda13f56b9ad71cab59102daed5a9 |
| MD5 hash: | 717fbb237f8ec5a350a1f9fe35e8dc5e |
| humanhash: | vermont-sierra-moon-cola |
| File name: | 717fbb237f8ec5a350a1f9fe35e8dc5e.exe |
| Download: | download sample |
| Signature | DanaBot |
| File size: | 1'135'104 bytes |
| First seen: | 2021-07-21 18:06:34 UTC |
| Last seen: | 2021-07-21 19:10:01 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 266aa3b561e26e3b4d438fb26814163c (1 x DanaBot, 1 x RedLineStealer, 1 x ArkeiStealer) |
| ssdeep | 24576:wDPYAIHIXqX2hBCoLsPdkUrHBlhnjXAEmB+31pFy+L:wDgzI6X2hBubuM31pFL |
| Threatray | 2'751 similar samples on MalwareBazaar |
| TLSH | T19235230136E1E972D591093260F78394AAFFBCA75D789A47A1193AEF3F301C496BC316 |
| dhash icon | 48b9b2b0e8c18c90 (18 x RaccoonStealer, 5 x Smoke Loader, 3 x Glupteba) |
| Reporter |  abuse_ch |
| Tags: | DanaBot exe |
Intelligence
File Origin
# of uploads :
2
# of downloads :
195
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
717fbb237f8ec5a350a1f9fe35e8dc5e.exe
Verdict:
Malicious activity
Analysis date:
2021-07-21 18:13:55 UTC
Tags:
trojan danabot
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Verdict:
Malicious
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
84 / 100
Signature
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Bingoml
Status:
Malicious
First seen:
2021-07-21 04:18:37 UTC
AV detection:
19 of 28 (67.86%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
unknown
Similar samples:
+ 2'741 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
8/10
Tags:
n/a
Behaviour
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Loads dropped DLL
Blocklisted process makes network request
Unpacked files
SH256 hash:
f04c14adc92fcb5c10a00484e705397b5597930c7915cd5a1147b4c742f439da
MD5 hash:
00ff83979f4cc5eaf1aa08e4cd33edc6
SHA1 hash:
5f6a6d4d1b34b7f5a46591fe027092c6cc9b3194
SH256 hash:
d5c6ba19c1266b7c6c9bf2c95b4acd79d35ad568004fe2bb4c9d83953a69a009
MD5 hash:
cf938ba4ab240423c1b5e7d5f478cf63
SHA1 hash:
0cb97e2d169e4ccd6c5782cd2726bf03ab277020
SH256 hash:
7277ba54308bcc7098ac8be7c268a99edce0dbd0b49536b36acca25ca06b5de6
MD5 hash:
717fbb237f8ec5a350a1f9fe35e8dc5e
SHA1 hash:
fb3b8701c0dfda13f56b9ad71cab59102daed5a9
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.