MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8c98355387cdad4550e82d642575634034955262583962b63617d8e2d79956bd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DanaBot


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8c98355387cdad4550e82d642575634034955262583962b63617d8e2d79956bd
SHA3-384 hash: 5b715b0c129b1d0e7bbffe6f67ffe295ede70a82aa0a90a599b2a40a414bba68eee5d121fe8f2df0ac182e2f17b6583a
SHA1 hash: a7dadbba24f6b98f84b073f999dab22c9c8ecfd4
MD5 hash: 5f8c7a8a8095a14d504172acff266239
humanhash: spaghetti-mango-ceiling-sad
File name:5f8c7a8a8095a14d504172acff266239.exe
Download: download sample
Signature DanaBot
Create hunting rule
File size:1'100'288 bytes
First seen:2020-05-25 18:03:46 UTC
Last seen:2020-05-25 18:58:45 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 9cfc592e3d6d0e6b5ee760e399e7ceea (1 x DanaBot)
ssdeep 12288:TgkCuzBIfToMb1p0X6x28MVhULkfPGp3cJfdkqBnm9shOY44cOjFyuDU6dmfcVz0:844ZbK6x2SLknGCJC9sgscoFyuDJ1Vz
Threatray 42 similar samples on MalwareBazaar
TLSH BB351213F2E06E3CE1F38A31596DDAD55E6EB4630E376ABB2344561F2C310C19B6271A
Reporter abuse_ch
Tags:DanaBot exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
810
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BehavesLike.Win32.IRCBot.tc.3761.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-25 18:35:37 UTC
File Type:
PE (Exe)
Extracted files:
42
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
310d801624fa3aec311040427326e4e7d500f6b2a0fbfde77e34df4617c155f1
DanaBot
46c14ac886a864d3ff77606286c4ce983a060d57bcd07881ab299b1848918af5
DanaBot
62e5d2d34e0a074f96f9c3dbb9b27bab862a1d23e2a0062ca6d9889d6fe0b30d
DanaBot
af0b53ecd547b0a629164b818d8562a5b6c3a3c15d89a764fcdc87cf0f6d4489
DanaBot
bb53f47b4c6693ad29934983c001471b82827f659a724c97e2b1d13fd158fd34
DanaBot
c93e7028a1fa69efc978b71587df57ad05d06b9e290c33329c5f3fa83e10e247
DanaBot
e127b93395eb2d0cf5b3b1e43257b342fb51f7b68e55615aed0366c2d313b875
DanaBot
e444e98ee06dc0e26cae8aa57a0cddab7b050db22d3002bd2b0da47d4fd5d78c
DanaBot
f377512454adebec7f32f1a33bda63e3476595be7857fb73c0e242407f29f616
DanaBot
f7e6d70e5553fb8c221304bf51126f457d4825194c4ef4f98915b28eb9942326
DanaBot
+ 32 additional samples on MalwareBazaar
Result
Malware family:
danabot
Create hunting rule
Score:
  10/10
Tags:
family:danabot banker botnet trojan
Link:
https://tria.ge/reports/201109-bk2s3wg6b6/
Behaviour
Suspicious use of WriteProcessMemory
Loads dropped DLL
Blacklisted process makes network request
Danabot
Danabot x86 payload
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DanaBot

Executable exe 8c98355387cdad4550e82d642575634034955262583962b63617d8e2d79956bd

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/367844/
  
Delivery method
Distributed via web download

Comments