MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 7d3b2e91c3cfb16df02f63b973c69a2047b8031295a49e4fffa0fad3dba975f0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
DanaBot
Vendor detections: 13
| SHA256 hash: | 7d3b2e91c3cfb16df02f63b973c69a2047b8031295a49e4fffa0fad3dba975f0 |
|---|---|
| SHA3-384 hash: | 6e312ec4b160ffde5673545568e8e086d65a87299e2ad527714bd146d3aacb1ca33c14fee6a4e3330ad1978413c9eb5d |
| SHA1 hash: | ee9da83f51b904db29d14847a013c4cff7ea6711 |
| MD5 hash: | f8151b5d4c4e62166a8c2e914f54cbb7 |
| humanhash: | cold-artist-autumn-maine |
| File name: | f8151b5d4c4e62166a8c2e914f54cbb7 |
| Download: | download sample |
| Signature | DanaBot |
| File size: | 1'164'800 bytes |
| First seen: | 2022-01-08 16:08:12 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 3f07075ef838296be9ff2ad3cf3a6bc2 (2 x RedLineStealer, 1 x KPOTStealer, 1 x ArkeiStealer) |
| ssdeep | 24576:xEsbnZPBs/qcdQHsqWr+c6NKuSOxHsKRKUkMwlxCQ9Z4h:xvzZPBs/qOQHPWr+cEKR6MKRKxMwXj9M |
| Threatray | 482 similar samples on MalwareBazaar |
| TLSH | T1C645236033F2D830E8F649B10575D7E19E3FF8421510925EBB18339A5F73DA66A2A327 |
| File icon (PE): |  |
| dhash icon | fcfcf4d4d4d4d8c0 (41 x RedLineStealer, 30 x RaccoonStealer, 9 x Smoke Loader) |
| Reporter |  zbetcheckin |
| Tags: | 32 DanaBot exe |
Intelligence
File Origin
# of uploads :
1
# of downloads :
630
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
f8151b5d4c4e62166a8c2e914f54cbb7
Verdict:
Malicious activity
Analysis date:
2022-01-08 16:13:36 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
DanaBot
Result
Verdict:
Suspicious
Maliciousness:
Behaviour
Creating a file
Enabling the 'hidden' option for recently created files
DNS request
Launching a process
Creating a process with a hidden window
Result
Malware family:
n/a
Score:
9/10
Tags:
n/a
Behaviour
MalwareBazaar
SystemUptime
MeasuringTime
CPUID_Instruction
CheckCmdLine
EvasionQueryPerformanceCounter
EvasionGetTickCount
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
greyware packed tofsee
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Verdict:
Malicious
Result
Threat name:
DanaBot
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Signature
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Contains functionality to detect sleep reduction / modifications
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Yara detected DanaBot stealer dll
Behaviour
Behavior Graph:
Threat name:
Win32.Packed.Generic
Status:
Suspicious
First seen:
2022-01-08 15:50:43 UTC
File Type:
PE (Exe)
Extracted files:
24
AV detection:
23 of 28 (82.14%)
Threat level:
1/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 472 additional samples on MalwareBazaar
Result
Malware family:
danabot
Score:
10/10
Tags:
family:danabot botnet:4 banker trojan
Behaviour
Suspicious use of WriteProcessMemory
Loads dropped DLL
Danabot
Danabot Loader Component
Malware Config
C2 Extraction:
192.119.110.4:443
192.236.194.72:443
192.236.194.72:443
Unpacked files
SH256 hash:
916fe5393412e45decc9e4af37255738dec2386602b3fdc9123689e471b1792f
MD5 hash:
cb279827ba2fbad4255549af48dbf33c
SHA1 hash:
eadd809914b9756d8f89bacf17637dab25156045
SH256 hash:
46610fba93612d077a1ec40bd7176a1329713766077708ef4228d3994e32fdac
MD5 hash:
28082b3c42b9b2261c903a793dfc1c4b
SHA1 hash:
2b761a0b4c042ad536b2273fd6646d00497b84fe
SH256 hash:
7d3b2e91c3cfb16df02f63b973c69a2047b8031295a49e4fffa0fad3dba975f0
MD5 hash:
f8151b5d4c4e62166a8c2e914f54cbb7
SHA1 hash:
ee9da83f51b904db29d14847a013c4cff7ea6711
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.url : hxxp://152.89.247.194/permit.exe