MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 84e660c32168446d208e21adc81cf55bb65734cea4da324ea6ec582324b311bb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DanaBot


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 84e660c32168446d208e21adc81cf55bb65734cea4da324ea6ec582324b311bb
SHA3-384 hash: 348602960de1dc33981a2e2b1840cf9f9f409f2035c278f9bbd7f3fada3dc6a259a1afd0b61044e14d7f26523b8986c5
SHA1 hash: 600b22a4da6f2747a50865175771aeb2201a3793
MD5 hash: 3a0895b2b492bf8da905ce273f106dff
humanhash: october-hamper-bluebird-aspen
File name:3a0895b2b492bf8da905ce273f106dff.dll
Download: download sample
Signature DanaBot
Create hunting rule
File size:2'588'672 bytes
First seen:2021-10-29 18:35:53 UTC
Last seen:2021-10-29 20:19:01 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 962570fbbec5a88ee4b45ad011cc651b (1 x DanaBot)
ssdeep 49152:LgZziYTi//YHt2Z/fZMdzUAOC5n+LlrxFTGWsKq:L0ziYTnN2Z/f6AAOGarxFTGzv
Threatray 7 similar samples on MalwareBazaar
TLSH T145C54C2033B69812F273133598F3D0E09ED8BD6299B4AD4B70C23B5F049F6D29A5975E
Reporter abuse_ch
Tags:DanaBot dll

Intelligence

File Origin
# of uploads :
2
# of downloads :
318
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen15.31149.1345.8224.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Enabling the 'hidden' option for analyzed file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/70d72eaa-a313-47b5-a407-d960e35a8819
Result
Threat name:
DanaBot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/879575
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Yara detected DanaBot stealer dll
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 512010 Sample: v8cMgp4Fd0.dll Startdate: 29/10/2021 Architecture: WINDOWS Score: 76 23 Found malware configuration 2->23 25 Multi AV Scanner detection for submitted file 2->25 27 Yara detected DanaBot stealer dll 2->27 29 C2 URLs / IPs found in malware configuration 2->29 7 loaddll32.exe 2 2->7         started        process3 process4 9 rundll32.exe 1 7->9         started        12 rundll32.exe 1 7->12         started        15 cmd.exe 1 7->15         started        17 rundll32.exe 1 7->17         started        dnsIp5 31 System process connects to network (likely due to code injection or exploit) 9->31 21 185.158.250.216, 443, 49749, 49750 M247GB Netherlands 12->21 19 rundll32.exe 1 15->19         started        signatures6 process7
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/84e660c32168446d208e21adc81cf55bb65734cea4da324ea6ec582324b311bb/
Threat name:
Win32.Trojan.DanaBot
Create hunting rule
Status:
Malicious
First seen:
2021-10-29 18:33:00 UTC
AV detection:
22 of 44 (50.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qttgbqzbnbcg2ieoegw4qhhvlo3fongoutndetvg5rmcgjftcg5q._file
Verdict:
malicious
Label(s):
gozi
Create hunting rule
Similar samples:
2203d02a6aa593c823a8ad01a2b9fe25bd224832d04af253c7c1d0412d591756
DanaBot
2a3acdcd76575762b18c18c644a745125f55ce121f742d2aad962521bc7f25fd
DanaBot
5ca2a5d2ec7cee822027375ef676891f3501dad244c504807b9daa6d87cf0ac1
DanaBot
6901d27fd099c6211ec944208df34dc1b75cfffb994bc84e9eeadb9b7c183166
DanaBot
bb2e7b341aa7b7c75e148ca1b4eff2997626655e1d06329598d5a2c3be91f18a
DanaBot
c7518bcebe1116c9972db08a2fe2461351e21cb65e7659cd806324364bfea2df
DanaBot
Result
Malware family:
danabot
Create hunting rule
Score:
  10/10
Tags:
family:danabot banker trojan
Link:
https://tria.ge/reports/211029-w8w3ladha8/
Behaviour
Suspicious use of WriteProcessMemory
Blocklisted process makes network request
Danabot
Danabot Loader Component
Malware Config
C2 Extraction:
185.158.250.216:443
194.76.225.46:443
45.11.180.153:443
194.76.225.61:443
Unpacked files
SH256 hash:
cd29beede666dd7903b004a35621e675c33cbcc5e9db812e3e9ccd4c98204e93
MD5 hash:
7ebf388a7d9506ce10258efb3c890bf1
SHA1 hash:
695284098eeaca82453e18c8fc883f4e3155c493
Link:
https://www.unpac.me/results/84b46cbc-e2ba-44d9-a49e-7176c06ef84a/
SH256 hash:
84e660c32168446d208e21adc81cf55bb65734cea4da324ea6ec582324b311bb
MD5 hash:
3a0895b2b492bf8da905ce273f106dff
SHA1 hash:
600b22a4da6f2747a50865175771aeb2201a3793
Link:
https://www.unpac.me/results/84b46cbc-e2ba-44d9-a49e-7176c06ef84a/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/84e660c32168446d208e21adc81cf55bb65734cea4da324ea6ec582324b311bb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DanaBot

DLL dll 84e660c32168446d208e21adc81cf55bb65734cea4da324ea6ec582324b311bb

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1707747/
  
Delivery method
Distributed via web download

Comments