MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7b28129eaa03d71ef87389dbeef37817fce2607c5fb2833b6803d92795bb79bf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DanaBot


Vendor detections: 12


Intelligence 12 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7b28129eaa03d71ef87389dbeef37817fce2607c5fb2833b6803d92795bb79bf
SHA3-384 hash: ecc6ad350f5b15f5534091727b1cb40b75d212db3038807af5d050c047e6b57f136383cb475fcdeb602e81b2642583e7
SHA1 hash: 7309694fa4a9625351d4fa307a6ccd2e01e31791
MD5 hash: 1fb696816a41af9bb6d2de969437eeab
humanhash: salami-papa-grey-louisiana
File name:1fb696816a41af9bb6d2de969437eeab.exe
Download: download sample
Signature DanaBot
Create hunting rule
File size:1'269'760 bytes
First seen:2021-10-18 11:14:58 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash d29112deebad1bc2847e7571006fa346 (1 x DanaBot, 1 x GCleaner, 1 x Smoke Loader)
ssdeep 24576:IBWjhERO2Q2PxbUsCKULdHN8ME7SVstG1de7ld8UiFPZz:ANQ2Px4RKULRmlOsyg7
Threatray 6'595 similar samples on MalwareBazaar
TLSH T169450110E651C039F4BBD2F489BA126BA93E7FA06B1490CB53D91AEE57745E0ED3031B
File icon (PE):PE icon
dhash icon 5412b0e068696c46 (1 x Loki, 1 x DanaBot, 1 x CryptBot)
Reporter abuse_ch
Tags:DanaBot exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
272
Origin country :
n/a
Vendor Threat Intelligence
Detection:
DanaBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/198117/
Detection(s):
Win.Trojan.Generic-9903173-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file
Enabling the 'hidden' option for recently created files
Launching a process
Creating a process with a hidden window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/616d573a9a5a1e91c5c3afca/reports/06bb49f8-1aaa-440c-9e56-6627822e0197/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/65b13769-8486-4503-b9d8-5539120d7ae8
Result
Threat name:
DanaBot
Create hunting rule
Detection:
malicious
Classification:
evad.troj
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/872185
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Yara detected DanaBot stealer dll
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7b28129eaa03d71ef87389dbeef37817fce2607c5fb2833b6803d92795bb79bf/
Threat name:
Win32.Trojan.Ulise
Create hunting rule
Status:
Malicious
First seen:
2021-10-18 09:14:59 UTC
AV detection:
27 of 44 (61.36%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pmubfhvkaplr56dtrhn6543yc76oeyd4l6zigo3iapmspfn3pg7q._file
Verdict:
malicious
Similar samples:
173240b443fdb5cc7ed97cf6eedeb0d823924df3dab6d468c9da2898443f3ac6
DanaBot
1bceb4e84115eabb8bf3df704b5cc014834ca08b126451ae95d60a968e66d666
DanaBot
2793bbaba9d12a4a740b6c957143367ce1fb13bb98ecb122e2cb41728bed525e
DanaBot
2fbf6c5454bb88073ecbc13b293375ec58a9f8636c188881ffd7a3573f3c1cac
DanaBot
596e82d24c64a373095159ee769df582d6f34fde24eb537aca442d8f01c491db
DanaBot
69fac4fe77b6da550498724f01e6db66d5c18a19c185d824bf62afdaccb0a7d6
DanaBot
721bf1dd5787108ecf31dd3bbab5e355ca55bdc68eb2358ce891290a7ce2048c
DanaBot
786b9cb2fa5e78e4bc0d9e67e6f90c0229b150bacfd3e75cf46a9c3a67d57a67
DanaBot
8f71fca5621ccb7ba3558cfebc17014d27923d1c73ad97ececb577fd5b937047
DanaBot
8fa3eaa46c7d8d1f44a2eeca895f802f2aa7a2251bab347ccb765c72d63ccb58
DanaBot
+ 6'585 additional samples on MalwareBazaar
Result
Malware family:
danabot
Create hunting rule
Score:
  10/10
Tags:
family:danabot banker trojan
Link:
https://tria.ge/reports/211018-nckexsedbr/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Drops file in Program Files directory
Loads dropped DLL
Blocklisted process makes network request
Danabot
Danabot Loader Component
Suspicious use of NtCreateProcessExOtherParentProcess
Unpacked files
SH256 hash:
32a060e186c81266b1f45e542d89c6c01d684aae0b8a2bdf1b4a86c83c0ce3a3
MD5 hash:
4f5107913bc28d77679f52fa25fb7c00
SHA1 hash:
744e11726acb3ccec925abe6c3393f575d779bcd
Link:
https://www.unpac.me/results/6a274e37-65f1-4f85-bbc1-0d607752ac2e/
SH256 hash:
7b28129eaa03d71ef87389dbeef37817fce2607c5fb2833b6803d92795bb79bf
MD5 hash:
1fb696816a41af9bb6d2de969437eeab
SHA1 hash:
7309694fa4a9625351d4fa307a6ccd2e01e31791
Link:
https://www.unpac.me/results/6a274e37-65f1-4f85-bbc1-0d607752ac2e/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/7b28129eaa03/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7b28129eaa03d71ef87389dbeef37817fce2607c5fb2833b6803d92795bb79bf

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:adonunix2
Create hunting rule
Author:Tim Brown @timb_machine
Description:AD on UNIX

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DanaBot

Executable exe 7b28129eaa03d71ef87389dbeef37817fce2607c5fb2833b6803d92795bb79bf

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/198117/
  
URLhaus
https://urlhaus.abuse.ch/url/1660814/
  
Delivery method
Distributed via web download

Comments