MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 893807a4d627a0891392bb34d49c32f78e29f11ea2718bcb239a306751bc50a1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DanaBot


Vendor detections: 11


Intelligence 11 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 893807a4d627a0891392bb34d49c32f78e29f11ea2718bcb239a306751bc50a1
SHA3-384 hash: c424de93c826679e1e4939fce889a726c17378f30e30d190826d8cfc3f591a15ef2bec1f6498810eecc68c906341add4
SHA1 hash: 03799871198fbd6166101eb1eaf1254b43fdefd3
MD5 hash: 41c450a5a4b21b9112cc6f6b2847200a
humanhash: skylark-march-tennessee-west
File name:41c450a5a4b21b9112cc6f6b2847200a.exe
Download: download sample
Signature DanaBot
Create hunting rule
File size:1'191'424 bytes
First seen:2022-12-13 16:09:57 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash ad10dd64c386884f70520e2be24d9dbb (12 x Smoke Loader, 1 x RecordBreaker, 1 x DanaBot)
ssdeep 24576:ChBJ7E/gBXj+5/maJs0+e0kq5vrW01Y9Oxpk1vbgDCS69T3zBV1:C3JPz+kj0+7zeAg1kabtV
Threatray 35 similar samples on MalwareBazaar
TLSH T1504523127650D473C5115D39E82AFBDCDAEBF8119624C636AF181B1F2EF22E04666B0F
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 480c445c56591904 (1 x Smoke Loader, 1 x DanaBot)
Reporter abuse_ch
Tags:DanaBot exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
197
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
41c450a5a4b21b9112cc6f6b2847200a.exe
Verdict:
Malicious activity
Analysis date:
2022-12-13 16:13:18 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/b763cbe8-fec9-4cf3-99a2-ac1666f5c70c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/345895/
Detection(s):
Win.Packer.pkr_ce1a-9980177-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Creating a window
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Searching for the window
Sending a custom TCP request
Sending an HTTP GET request
Сreating synchronization primitives
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/6398a3dc485d8463dc4160f6/reports/43b5bc81-4031-49c6-a3e7-f1fe4ce3494f/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/861f2a49-5d51-49f8-a6a2-df520d6b94de
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/1133546
Signature
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/893807a4d627a0891392bb34d49c32f78e29f11ea2718bcb239a306751bc50a1/
Threat name:
Win32.Trojan.SmokeLoader
Create hunting rule
Status:
Malicious
First seen:
2022-12-13 12:44:05 UTC
File Type:
PE (Exe)
Extracted files:
56
AV detection:
28 of 40 (70.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=re4apjgwe6qise4sxm2njhbs66hct4i6ujyyxszdtiygoun4kcqq._file
Verdict:
malicious
Similar samples:
034a5406b76b4bd449648cd166a25e6d073b71a9a4ead464ef70bfcec5acfa7f
DanaBot
209623f82b569fb476fdef4b1b84b253fd7b224ec5161867e134783a1ae30740
DanaBot
2b610520f96a2e63100ec1433f822e7eeb2cf069b2006560ec42619c6dfe4d30
DanaBot
5f68ee5d17015571bbd0707a228004e39d71d461ce0d783c7b90f48ede7a45f8
DanaBot
82d8c107a3489fc8f149fde6469c51309a14fcd816d33d0a709af4b5ffc44ed4
DanaBot
bcbf1a4e0e0c081d97edc36d5889a78278a4f5c51b48be0ba84aa368c35d71dd
DanaBot
c1a6950add3c21f8a22d63247c7aa67e7ef66aa4fcc207e582b48e755521be23
DanaBot
c8c043112b7f6ca1275a197add49d5d6d544f4290bd7a8da3ff5b24a11bf28b9
DanaBot
cda8ffa2a84daf8097f5ca919b6b350cd30b697565bbae6d8adbfab217d476e8
DanaBot
+ 25 additional samples on MalwareBazaar
Result
Malware family:
danabot
Create hunting rule
Score:
  10/10
Tags:
family:danabot banker trojan
Link:
https://tria.ge/reports/221213-tmd9jsfa93/
Behaviour
Checks processor information in registry
Modifies registry class
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of SetThreadContext
Loads dropped DLL
Blocklisted process makes network request
Danabot
Verdict:
Informative
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/ac3bd222-5ca6-4595-a654-a9cdb5603e44
Unpacked files
SH256 hash:
2cc04786e6910d52db3cf0f1d1f51f05553eb3da221da1c403ed7fc896878a29
MD5 hash:
ca344ccd5f59072b111dc7c1d5b2fcf0
SHA1 hash:
1daccf44079711b2cd92d4d84ad3272d0fe13caa
Link:
https://www.unpac.me/results/a90be4af-cc1e-4fde-92fc-9f9efebfd617/
SH256 hash:
49205dbfad6db8edb8676710989dff9045117c8dd87a99b763ad0456be2054d6
MD5 hash:
8287d08f1e9e4ea6810c21f596fb506e
SHA1 hash:
fc4a7f4ddb6d865fe903b62e60fd7912ce62c472
Link:
https://www.unpac.me/results/a90be4af-cc1e-4fde-92fc-9f9efebfd617/
SH256 hash:
893807a4d627a0891392bb34d49c32f78e29f11ea2718bcb239a306751bc50a1
MD5 hash:
41c450a5a4b21b9112cc6f6b2847200a
SHA1 hash:
03799871198fbd6166101eb1eaf1254b43fdefd3
Link:
https://www.unpac.me/results/a90be4af-cc1e-4fde-92fc-9f9efebfd617/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/893807a4d627a0891392bb34d49c32f78e29f11ea2718bcb239a306751bc50a1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DanaBot

Executable exe 893807a4d627a0891392bb34d49c32f78e29f11ea2718bcb239a306751bc50a1

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2423260/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/345895/

Comments