MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8e76055823664f0cabcd8fdd17ccdef01f0dcc584346b59d8c0dfbfefa547ab2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DanaBot


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8e76055823664f0cabcd8fdd17ccdef01f0dcc584346b59d8c0dfbfefa547ab2
SHA3-384 hash: 2d6fe15a6eda0eddb0b4b6a2ca51fad90ad4ec7ae85f67ec292d4011c3a4ec9b6d206525280da9a40496020a9c26eb96
SHA1 hash: 4005a2fd5196ad145064278084430e6ef43380ed
MD5 hash: a05d9b29e34317da6d095e7330e6b216
humanhash: oklahoma-september-papa-twelve
File name:a05d9b29e34317da6d095e7330e6b216.exe
Download: download sample
Signature DanaBot
Create hunting rule
File size:5'521'017 bytes
First seen:2021-02-10 13:16:39 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash be41bf7b8cc010b614bd36bbca606973 (195 x LummaStealer, 126 x DanaBot, 63 x Vidar)
ssdeep 98304:GdJbRrAVY8XcVXkQwD/XYdDGgsUHaje2X+BlJzSm9oaGo4CG2qhSLSicE:GdJGVNcWLkRb2uBFqF/2uSLD
Threatray 58 similar samples on MalwareBazaar
TLSH CB4633BA774CCE70F4A538B71B88350FF5F1BAA3154D1916DB0C680A35628ABC77A391
Reporter abuse_ch
Tags:DanaBot exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
425
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/116545/
Detection(s):
SecuriteInfo.com.EXE.Obfus-4.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Creating a window
Creating a process from a recently created file
Deleting a recently created file
Searching for analyzing tools
Searching for the window
Creating a file in the %AppData% subdirectories
Sending a UDP request
DNS request
Sending an HTTP GET request
Creating a file
Sending a custom TCP request
Running batch commands
Creating a process with a hidden window
Launching a process
Enabling autorun by creating a file
Sending an HTTP GET request to an infection source
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Cryptbot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/604535
Signature
Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
Hides threads from debuggers
Machine Learning detection for dropped file
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Potentially malicious time measurement code found
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Yara detected Cryptbot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 351303 Sample: IUfCA7xuRJ.exe Startdate: 10/02/2021 Architecture: WINDOWS Score: 100 48 Antivirus detection for dropped file 2->48 50 Multi AV Scanner detection for submitted file 2->50 52 Detected unpacking (changes PE section rights) 2->52 54 7 other signatures 2->54 7 IUfCA7xuRJ.exe 20 2->7         started        10 SmartClock.exe 2->10         started        13 SmartClock.exe 2->13         started        process3 file4 30 C:\Users\user\AppData\Local\...\vpn_ico.exe, PE32 7->30 dropped 32 C:\Users\user\AppData\Local\...\6_ico.exe, PE32 7->32 dropped 34 C:\Users\user\AppData\Local\...\4_ico.exe, PE32 7->34 dropped 36 C:\Users\user\AppData\Local\Temp\...\UAC.dll, PE32 7->36 dropped 15 4_ico.exe 4 7->15         started        19 vpn_ico.exe 3 19 7->19         started        22 6_ico.exe 3 7->22         started        62 Hides threads from debuggers 10->62 64 Tries to detect sandboxes / dynamic malware analysis system (registry check) 10->64 signatures5 process6 dnsIp7 38 C:\Users\user\AppData\...\SmartClock.exe, PE32 15->38 dropped 44 Hides threads from debuggers 15->44 46 Tries to detect sandboxes / dynamic malware analysis system (registry check) 15->46 24 SmartClock.exe 15->24         started        40 ip-api.com 208.95.112.1, 49723, 80 TUT-ASUS United States 19->40 27 wscript.exe 12 19->27         started        file8 signatures9 process10 dnsIp11 56 Hides threads from debuggers 24->56 58 Tries to detect sandboxes / dynamic malware analysis system (registry check) 24->58 42 iplogger.org 88.99.66.31, 443, 49724 HETZNER-ASDE Germany 27->42 60 System process connects to network (likely due to code injection or exploit) 27->60 signatures12
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8e76055823664f0cabcd8fdd17ccdef01f0dcc584346b59d8c0dfbfefa547ab2/
Threat name:
Win32.Trojan.AntiVM
Create hunting rule
Status:
Malicious
First seen:
2021-02-10 06:13:03 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rz3akwbdmzhqzk6nr7orptg66apq3tcyindllhmmbx5756supkza._file
Verdict:
malicious
Similar samples:
029a8669597543f16beacbcd8fd0eedb0e2ea51a401e5d88bbbe4ef0d0c410c8
DanaBot
1ba569c631438a0fb356441838ff328835d607e7cdb217cc444923c1ec58337b
DanaBot
37cb831726dc1877ea59cf5618e4fa224368bbd64a7047dec6fb554a6a17d4c2
DanaBot
57e0906e3b6e13fe8db13cc06ce37d957bfc045afa6e99e9cf8b893ceb57d018
DanaBot
5c7291c8c0c9aae91453faabe543abd6da50a2600ba74cd9fd1faa18a939cd4b
DanaBot
a2f0a1d469d73a11c69afc9eb12000fa7f7652305d936a10d12dabce693f878b
DanaBot
ada1c5359c35e6b70c5a2d5533f9d725f86a1e155c8486bfd2941c9b40478ea2
DanaBot
adc220109f73acdd307036a6d14bffa68103a48e2305c3a4f1533aab74d9deb8
DanaBot
b87a93613d0004b0d07eb302e75cd7030cb2a4bf466e92cec234e0abd8e6e727
DanaBot
b99887f1364955d2872bedadab15a15a51429ec8aeb111859d50e24a9fd31342
DanaBot
+ 48 additional samples on MalwareBazaar
Result
Malware family:
danabot
Create hunting rule
Score:
  10/10
Tags:
family:danabot banker discovery evasion ransomware spyware trojan
Link:
https://tria.ge/reports/210210-evhek12bbn/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Modifies registry class
Modifies system certificate store
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks installed software on the system
Drops desktop.ini file(s)
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Checks BIOS information in registry
Drops startup file
Identifies Wine through registry keys
Loads dropped DLL
Reads user/profile data of web browsers
Blocklisted process makes network request
Executes dropped EXE
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Danabot
Malware Config
C2 Extraction:
172.93.201.39:443
134.119.186.198:443
192.236.192.241:443
104.168.156.222:443
Unpacked files
SH256 hash:
8e76055823664f0cabcd8fdd17ccdef01f0dcc584346b59d8c0dfbfefa547ab2
MD5 hash:
a05d9b29e34317da6d095e7330e6b216
SHA1 hash:
4005a2fd5196ad145064278084430e6ef43380ed
Link:
https://www.unpac.me/results/c12a3cfd-a3c6-4680-a89e-df987384dee7/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Glupteba
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8e76055823664f0cabcd8fdd17ccdef01f0dcc584346b59d8c0dfbfefa547ab2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DanaBot

Executable exe 8e76055823664f0cabcd8fdd17ccdef01f0dcc584346b59d8c0dfbfefa547ab2

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/998482/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/116545/

Comments