MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 84d476538f65a15834800d95f0056d5e0f1efcadbc7dc6155185286c6af962c2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DanaBot


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 84d476538f65a15834800d95f0056d5e0f1efcadbc7dc6155185286c6af962c2
SHA3-384 hash: 9042b4038b2319e08bfb8092d1b6db70cfed6c0be046ecf5fe13fdc307225b8f67a3b4149534b6920facaa9b3fd3af16
SHA1 hash: b78edd252282d086e6cb10bdce8d5412a2f78cee
MD5 hash: 8463e69ee4b0e16c4942d27175a00135
humanhash: iowa-vegan-gee-oklahoma
File name:8463e69ee4b0e16c4942d27175a00135.exe
Download: download sample
Signature DanaBot
Create hunting rule
File size:1'264'568 bytes
First seen:2021-05-26 06:03:08 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash be41bf7b8cc010b614bd36bbca606973 (195 x LummaStealer, 126 x DanaBot, 63 x Vidar)
ssdeep 24576:HMTh1ZwvzzUSVZUM04lhZux1TIMdM+64NudrXWbMDLAxKbhRcfGryp8hs3zg9dYT:st1ZwPnUMPjZe++AdywvASRcgs8h8EuT
Threatray 128 similar samples on MalwareBazaar
TLSH 454523931E98C4E5E55E8EB8CD716A2152B6EE213938D3766300BDDF7C33102991E39E
Reporter abuse_ch
Tags:DanaBot exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
268
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
704a4ebafde59fed66cb4859f1645d7e.exe
Verdict:
Malicious activity
Analysis date:
2021-05-25 23:51:54 UTC
Tags:
stealer trojan
Link:
https://app.any.run/tasks/8b94f381-0809-433a-b159-b08d4e995285

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Zeus
Create hunting rule
Link:
https://www.capesandbox.com/analysis/162224/
Detection(s):
Win.Packed.Filerepmalware-9864117-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Creating a window
Creating a file in the Program Files subdirectories
Deleting a recently created file
Creating a process from a recently created file
Running batch commands
Creating a process with a hidden window
Launching cmd.exe command interpreter
Sending a UDP request
Launching a process
Creating a file in the %AppData% subdirectories
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.spyw.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/792258
Signature
Contains functionality to register a low level keyboard hook
Delayed program exit found
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Machine Learning detection for dropped file
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Obfuscated command line found
Submitted sample is a known malware sample
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 424657 Sample: GtEIOQymIr.exe Startdate: 26/05/2021 Architecture: WINDOWS Score: 96 58 Multi AV Scanner detection for dropped file 2->58 60 Multi AV Scanner detection for submitted file 2->60 62 Detected unpacking (changes PE section rights) 2->62 64 4 other signatures 2->64 10 GtEIOQymIr.exe 25 2->10         started        13 SmartClock.exe 2->13         started        15 SmartClock.exe 2->15         started        process3 file4 44 C:\Users\user\AppData\Local\Temp\...\vpn.exe, PE32 10->44 dropped 46 C:\Users\user\AppData\Local\Temp\...\4.exe, PE32 10->46 dropped 48 C:\Users\user\AppData\Local\Temp\...\UAC.dll, PE32 10->48 dropped 50 3 other files (none is malicious) 10->50 dropped 17 vpn.exe 7 10->17         started        19 4.exe 4 10->19         started        process5 file6 22 cmd.exe 1 17->22         started        42 C:\Users\user\AppData\...\SmartClock.exe, PE32 19->42 dropped 25 SmartClock.exe 19->25         started        process7 signatures8 66 Submitted sample is a known malware sample 22->66 68 Obfuscated command line found 22->68 70 Uses ping.exe to sleep 22->70 72 Uses ping.exe to check the status of other devices and networks 22->72 27 cmd.exe 3 22->27         started        30 conhost.exe 22->30         started        process9 signatures10 74 Obfuscated command line found 27->74 76 Uses ping.exe to sleep 27->76 32 PING.EXE 1 27->32         started        35 Ricordarmi.exe.com 27->35         started        37 findstr.exe 1 27->37         started        process11 dnsIp12 52 127.0.0.1 unknown unknown 32->52 54 192.168.2.1 unknown unknown 32->54 39 Ricordarmi.exe.com 35->39         started        process13 dnsIp14 56 WtzBPWYqDxvfg.WtzBPWYqDxvfg 39->56
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/84d476538f65a15834800d95f0056d5e0f1efcadbc7dc6155185286c6af962c2/
Threat name:
Win32.Trojan.Azorult
Create hunting rule
Status:
Malicious
First seen:
2021-05-25 22:30:45 UTC
File Type:
PE (Exe)
Extracted files:
52
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Verdict:
suspicious
Similar samples:
2051799f92fd036d6e1c8a9c06a4aea85a9509214cd0623c0df2fe62bd99986b
DanaBot
305df52e17cf7e129ece5188cd9bf51102fda9ac812d597c3e29314b06e8b3b8
DanaBot
8c085bb6591e5d7b0846eda3d7758a1c882be7f5bfb35210c831dc52848c6fa9
DanaBot
8cec146d7a7b594cf7748b35c63ea1fed2c994ef2cdbb5731f1b15d9c9fa1ee3
DanaBot
a5c463db805e356cb6e73e5676b397eab265e061c6797e27b626b8b4aee892a3
DanaBot
bd7c41dee6aba2b2d13e5ae39169242ed463a43366eec28a438f74db717d15f4
DanaBot
e9da1da3a4fb2050b9b17f5dbb1dd5f334f22637fc8186052d152cc631839f9b
DanaBot
fa83c0bb710987cdf1c5ed15400d938bc818d20c34af9e96e8cd99fc2ac3a172
DanaBot
fc2a8472021c1f37e7ba14fd51259d37d10bd030ecd33134ebf42d3279ab860a
DanaBot
fe68a629898384bb2edf90406da4c9d6764fd04e5337514e7edd9c2c608d2242
DanaBot
+ 118 additional samples on MalwareBazaar
Result
Malware family:
danabot
Create hunting rule
Score:
  10/10
Tags:
family:danabot botnet:3 banker discovery spyware stealer trojan
Link:
https://tria.ge/reports/210526-yhw3ht4gd2/
Behaviour
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Checks processor information in registry
Modifies system certificate store
Runs ping.exe
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Enumerates physical storage devices
Program crash
Drops file in Program Files directory
Checks installed software on the system
Drops desktop.ini file(s)
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Drops startup file
Loads dropped DLL
Reads user/profile data of web browsers
Blocklisted process makes network request
Downloads MZ/PE file
Executes dropped EXE
Danabot
Malware Config
C2 Extraction:
184.95.51.183:443
184.95.51.175:443
192.210.198.12:443
184.95.51.180:443
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/84d476538f65a15834800d95f0056d5e0f1efcadbc7dc6155185286c6af962c2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DanaBot

Executable exe 84d476538f65a15834800d95f0056d5e0f1efcadbc7dc6155185286c6af962c2

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/162224/
  
URLhaus
https://urlhaus.abuse.ch/url/1283749/
  
Delivery method
Distributed via web download

Comments