MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 88663e1a68a0c23a6b4e3bbdf5a274a374422aed105f52b236e58acd45050677. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DanaBot


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 88663e1a68a0c23a6b4e3bbdf5a274a374422aed105f52b236e58acd45050677
SHA3-384 hash: 56f31bad79ee1e2e3583c914b3de5698e96cad25b6dc7f8de15bdb6605120ad2a2a53aff56ecd0c9842e901d23def462
SHA1 hash: d516d47b4c1880d8fbaae0445c9b9150bf525d7d
MD5 hash: a59ceb8b32964dded00f40a534c72539
humanhash: wyoming-cat-hot-orange
File name:dellsvhosts.exe
Download: download sample
Signature DanaBot
Create hunting rule
File size:1'179'648 bytes
First seen:2021-09-16 12:26:13 UTC
Last seen:2021-09-16 13:00:26 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 493d9235e00e760cd832c2d6518be9c0 (2 x RaccoonStealer, 1 x DanaBot, 1 x ArkeiStealer)
ssdeep 24576:0+ug8A0Pa5ygPsEg2lE+bi5xord867JvbBJQ7dly3JXn4MLRM:0+9Qa5ygkEgqrkxoa67JDB6hwJXnHRM
Threatray 5'336 similar samples on MalwareBazaar
TLSH T156451224BBE1C034F0BB52F4997A93BD693D39705B24D1CB12D52AEA5A743E89C3035B
dhash icon 5012b2e068696c46 (2 x RaccoonStealer, 1 x CryptBot, 1 x DanaBot)
Reporter benkow_
Tags:DanaBot exe


Avatar
benkow_
Gcleaner -> http://cazdoh05. top/download.php?file=file.exe cryptbot -> http://23.106.122. 213/dellsvhosts.exe Danabot

Intelligence

File Origin
# of uploads :
2
# of downloads :
518
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
dellsvhosts.exe
Verdict:
Malicious activity
Analysis date:
2021-09-16 12:29:32 UTC
Tags:
trojan danabot
Link:
https://app.any.run/tasks/40f48325-348e-4adc-b44c-db7155cbe0ab

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/188422/
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware1.25296.18444.UNOFFICIAL
Create hunting rule

Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Creating a file
Enabling the 'hidden' option for recently created files
Launching a process
Creating a process with a hidden window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/617522769a5a1e91c5d204ef/reports/47f15b71-097e-401f-b1a3-2c9de8b57c66/overview
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6fbd8432-e318-42d4-8da2-81b6470c309d
Result
Threat name:
DanaBot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/852054
Signature
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Yara detected DanaBot stealer dll
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/88663e1a68a0c23a6b4e3bbdf5a274a374422aed105f52b236e58acd45050677/
Threat name:
Win32.Trojan.Azorult
Create hunting rule
Status:
Malicious
First seen:
2021-09-16 12:27:07 UTC
AV detection:
22 of 28 (78.57%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
1bceb4e84115eabb8bf3df704b5cc014834ca08b126451ae95d60a968e66d666
DanaBot
2793bbaba9d12a4a740b6c957143367ce1fb13bb98ecb122e2cb41728bed525e
DanaBot
2fbf6c5454bb88073ecbc13b293375ec58a9f8636c188881ffd7a3573f3c1cac
DanaBot
596e82d24c64a373095159ee769df582d6f34fde24eb537aca442d8f01c491db
DanaBot
69fac4fe77b6da550498724f01e6db66d5c18a19c185d824bf62afdaccb0a7d6
DanaBot
786b9cb2fa5e78e4bc0d9e67e6f90c0229b150bacfd3e75cf46a9c3a67d57a67
DanaBot
8f71fca5621ccb7ba3558cfebc17014d27923d1c73ad97ececb577fd5b937047
DanaBot
8fa3eaa46c7d8d1f44a2eeca895f802f2aa7a2251bab347ccb765c72d63ccb58
DanaBot
dab48eb20191f37e19aed12dc58640ab40957cec26dc3fa63a88f70decbd875c
DanaBot
fc576ede17e81cc2d5229f3a8ff900df35ba9c46fef5c67c8bb0fbb83f418b3e
DanaBot
+ 5'326 additional samples on MalwareBazaar
Result
Malware family:
danabot
Create hunting rule
Score:
  10/10
Tags:
family:danabot banker trojan
Link:
https://tria.ge/reports/210916-pmr37agcem/
Behaviour
Suspicious use of WriteProcessMemory
Loads dropped DLL
Blocklisted process makes network request
Danabot
Danabot Loader Component
Unpacked files
SH256 hash:
5e842cf9299aab4bc98f7bf088b26894fb7e408d99bca4f73b6c9d6f1d63b609
MD5 hash:
e34d785fe5cce2cccddcd2037b1f45cf
SHA1 hash:
194e833f76dd7d69557bb5dc347c70906878c841
Link:
https://www.unpac.me/results/4d86c53c-2653-45ef-aee0-ec29f8bb0f7d/
SH256 hash:
65d83a81b5de7538cf82cb08345acf0c80e63a59496c3e57f19fc622798795e6
MD5 hash:
f8383f903feac9ddf98c061deb1940a1
SHA1 hash:
6aaa2cfa9f11bdf93a5ba1a939620e1cfcb0ea1f
Link:
https://www.unpac.me/results/4d86c53c-2653-45ef-aee0-ec29f8bb0f7d/
SH256 hash:
88663e1a68a0c23a6b4e3bbdf5a274a374422aed105f52b236e58acd45050677
MD5 hash:
a59ceb8b32964dded00f40a534c72539
SHA1 hash:
d516d47b4c1880d8fbaae0445c9b9150bf525d7d
Link:
https://www.unpac.me/results/4d86c53c-2653-45ef-aee0-ec29f8bb0f7d/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/88663e1a68a0c23a6b4e3bbdf5a274a374422aed105f52b236e58acd45050677

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
Gcleaner
  
Delivery method
Other
  
URLhaus
https://urlhaus.abuse.ch/url/1624777/
Cape
Cape
https://www.capesandbox.com/analysis/188422/

Comments