MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 910c9a0a2a273fe7008bc4ba1eac2eba7ecc8ac67a4755fb98565e19535ff56e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

DanaBot

Vendor detections: 12

Intelligence 12 IOCs YARA 1 File information Comments

SHA256 hash:	910c9a0a2a273fe7008bc4ba1eac2eba7ecc8ac67a4755fb98565e19535ff56e
SHA3-384 hash:	a953446240a81db686bb2181b17188829f2d80d8a2d31b859e8321ec8007023e5426503f689484264bf839a9068c6570
SHA1 hash:	283f68585773ef17fa5e24ee56cb69f80b5e8bc0
MD5 hash:	4ddcebc60792b6c09c46ad6510205bc7
humanhash:	table-stairway-july-california
File name:	SecuriteInfo.com.W32.AIDetect.malware2.25195.14130
Download:	download sample
Signature	DanaBot Create hunting rule
File size:	2'048'512 bytes
First seen:	2022-08-26 09:41:12 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	251e0778488db1a83cc15f9212538622 (6 x RedLineStealer, 2 x Stop, 2 x DanaBot)
ssdeep	49152:0IuZQHRvmcw6UJGRV0cM85h9BdgoZSH4Gnr0p:0IuGHU+wG/I8X9Iv4
Threatray	511 similar samples on MalwareBazaar
TLSH	T1E0952311BBA0C435E5F602F489B5A6ADB56E3DA1972482CB17D43AEE1F741E0EC32347
TrID	48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 16.4% (.EXE) Win64 Executable (generic) (10523/12/4) 10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	9824e7d0c4e72158 (35 x RedLineStealer, 23 x Smoke Loader, 14 x ArkeiStealer)
Reporter	SecuriteInfoCom
Tags:	DanaBot exe

Intelligence

File Origin

# of uploads :

# of downloads :

444

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

danabot

ID:

File name:

SecuriteInfo.com.W32.AIDetect.malware2.25195.14130

Verdict:

Malicious activity

Analysis date:

2022-08-26 09:42:55 UTC

Tags:

danabot

Link:

https://app.any.run/tasks/bee81bf3-06cc-4aa8-a7bb-8ef2658f0c86

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/301368/

Detection(s):

SecuriteInfo.com.W32.AIDetect.malware2.25195.14130.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% directory

Launching a process

Creating a process with a hidden window

Launching the default Windows debugger (dwwin.exe)

Creating a window

Sending a custom TCP request

Searching for the window

Changing a file

Сreating synchronization primitives

Searching for synchronization primitives

Reading critical registry keys

Using the Windows Management Instrumentation requests

Stealing user critical data

Unauthorized injection to a system process

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware packed

Link:

https://www.filescan.io/uploads/630895ad393b1c8c47150393/reports/223512a2-dd73-42d3-b9e0-88ba9e8ee0ca/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

DanaBot

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/98768a40-3d7a-4d2b-af7b-cae31f1d08dc

Result

Threat name:

DanaBot

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1058293

Signature

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Tries to detect virtualization through RDTSC time measurements

Yara detected DanaBot stealer dll

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/910c9a0a2a273fe7008bc4ba1eac2eba7ecc8ac67a4755fb98565e19535ff56e/

Threat name:

Win32.Trojan.Waldek

Status:

Malicious

First seen:

2022-08-26 07:42:10 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

16 of 26 (61.54%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=segjucrke476oaelys5b5lboxj7mzcwgpjdvl64ykzpbsu276vxa._file

Verdict:

malicious

Result

Malware family:

danabot

Score:

10/10

Tags:

family:danabot banker collection discovery spyware stealer trojan

Link:

https://tria.ge/reports/220826-lpb8zabeg3/

Behaviour

Checks processor information in registry

Modifies registry class

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Enumerates physical storage devices

Program crash

Drops file in Program Files directory

Suspicious use of SetThreadContext

Accesses Microsoft Outlook accounts

Accesses Microsoft Outlook profiles

Checks installed software on the system

Drops desktop.ini file(s)

Loads dropped DLL

Reads user/profile data of web browsers

Blocklisted process makes network request

Danabot

Malware Config

C2 Extraction:

23.254.226.20:443
198.15.112.179:443
66.85.147.23:443

Unpacked files

SH256 hash:

b137893c1a7d264e51479a9f4b73ba8a0322d4a62a0834750b04bf43574087d1

MD5 hash:

03528423ab726a2474cbfb386d14817e

SHA1 hash:

5e973a84f864e0f0313f11c7f381faf443c42017

Link:

https://www.unpac.me/results/5e5bddaa-33c4-4c3a-8bcb-287f6005aa46/

SH256 hash:

db55957445c1f2b4345896cdf7fb3a1d5823bcf1a3dc57e6121977e40cb455fc

MD5 hash:

7e653410d65b72397fcff23b4343f00d

SHA1 hash:

9f561a239fadeb878af6323fde3abaa414ec12eb

Link:

https://www.unpac.me/results/5e5bddaa-33c4-4c3a-8bcb-287f6005aa46/

SH256 hash:

910c9a0a2a273fe7008bc4ba1eac2eba7ecc8ac67a4755fb98565e19535ff56e

MD5 hash:

4ddcebc60792b6c09c46ad6510205bc7

SHA1 hash:

283f68585773ef17fa5e24ee56cb69f80b5e8bc0

Link:

https://www.unpac.me/results/5e5bddaa-33c4-4c3a-8bcb-287f6005aa46/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/910c9a0a2a27/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/910c9a0a2a273fe7008bc4ba1eac2eba7ecc8ac67a4755fb98565e19535ff56e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.