MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 98c2f70c665efdfe6ff95460c0c8f131e80de91cf6dcbcf8bb4209c330280262. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DanaBot


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 98c2f70c665efdfe6ff95460c0c8f131e80de91cf6dcbcf8bb4209c330280262
SHA3-384 hash: b1d7cfe610fd00b92b8c4a508fe4d02185fd5ab78561b2a4c1e3942c50ccc81280a5d4c2ae4d5ef40da6eaa9c00847bd
SHA1 hash: eb325a88f3aa5ef0bb0ad94cb1bbcb3b976f4029
MD5 hash: 532a8713a93fff1d9e111cfe310ec41d
humanhash: nevada-jig-low-football
File name:532a8713a93fff1d9e111cfe310ec41d.exe
Download: download sample
Signature DanaBot
Create hunting rule
File size:2'701'312 bytes
First seen:2020-06-02 07:00:00 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 02d348a8421f80a2e65d117d6366a247 (1 x DanaBot)
ssdeep 49152:oUULw8Rg6cejProo051qLbnvmg3CNUcEhx8E893Ge1mkzkMkhGf:5P8RLccr5qg4UDx8EMJnsE
Threatray 66 similar samples on MalwareBazaar
TLSH 47C533206EE09078E896C8B49031CF42E5385C91F6A6CD6A1B8C3D1F6F79BD0D2D9637
Reporter abuse_ch
Tags:DanaBot exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
839
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Packed.Generickdz-7996014-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-01 21:09:37 UTC
File Type:
PE (Exe)
Extracted files:
31
AV detection:
18 of 31 (58.06%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=tdbpoddgl367437zkrqmbshrghua32i463olz6f3iie4gmbiajra._file
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
1464f141847f0ee9af9f7f2eda69ebcb56022ae8b1d259bb152a873d3c6a303d
DanaBot
3e6c762ae623b985932a24c99a901dfb7dcb7c452bd5668bf2d7e8883f99381f
DanaBot
4f9b6310c363bc29667d6624f373a78762061fe952494a242454be6550c374da
DanaBot
5128943bdbc08a1f56d6ca3c7be3ac65e7080341a2268c55e4280cee005505c0
DanaBot
95a90fbde8c6cc25ac3ebbc1bc9602a8a656a6c6d29e47378cca197c7018df02
DanaBot
991c4166a2246ca5ae9186a1e747f5eb767fdbd304dbfa1c5f4a2019cb6b4aec
DanaBot
9d96347ba7dd239d6a6b667242965905d6e96114281cd7a18812e901712a8303
DanaBot
a59a10879e0a2db88c6ea80f31a85962b7e4e89b6e2c4d4cac459b1580422b78
DanaBot
ba3478006a8f45f9979a6f2f363933093cd063f7845c85dc604c374481347c20
DanaBot
cd38592468e54623dc5c89529203dbc21ede6cfe95523d2f146449019288038c
DanaBot
+ 56 additional samples on MalwareBazaar
Result
Malware family:
danabot
Create hunting rule
Score:
  10/10
Tags:
family:danabot banker botnet trojan
Link:
https://tria.ge/reports/201109-8kawwszx4s/
Behaviour
Suspicious use of WriteProcessMemory
Loads dropped DLL
Blacklisted process makes network request
Danabot
Danabot x86 payload
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_danabot_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DanaBot

Executable exe 98c2f70c665efdfe6ff95460c0c8f131e80de91cf6dcbcf8bb4209c330280262

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/367844/
  
Delivery method
Distributed via web download

Comments