MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9ff6891ef4465e0a3ee08520c57c133ea47ea72c408c165d2aab578b007fadf9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DanaBot


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9ff6891ef4465e0a3ee08520c57c133ea47ea72c408c165d2aab578b007fadf9
SHA3-384 hash: b22d4453257064506f21d310e3661a7b7b56eff4d1d6e44ef5b255ce2c1c0b549c6e1c266b7a91ce0a0baebd6443cfc7
SHA1 hash: e6e9dec075e25687291ad4741e374c74f0a60298
MD5 hash: 546a5a09ff2e43a8b8989321c12cc95f
humanhash: blue-violet-summer-lamp
File name:546a5a09ff2e43a8b8989321c12cc95f.exe
Download: download sample
Signature DanaBot
Create hunting rule
File size:1'169'920 bytes
First seen:2022-03-05 18:20:15 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 0e7fe55f005b449b96d57439d1b37307 (2 x DanaBot)
ssdeep 24576:UIscSKINDNmfjaNVg0iVJcQa8HTxAEnopoE1ETRPvF:UIkPmfjOiV2Lae/eTpv
Threatray 9'845 similar samples on MalwareBazaar
TLSH T13E451210BAA0C03CE0B315F83175D37DA51EBDA1876591CB22DA2AFE66345E0FCB9257
File icon (PE):PE icon
dhash icon 2dac1378319b9b91 (29 x Smoke Loader, 23 x RedLineStealer, 22 x Amadey)
Reporter abuse_ch
Tags:DanaBot exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
554
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/247559/
Detection(s):
Win.Dropper.Generickdz-9939781-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Creating a window
Launching a process
Sending an HTTP GET request
Creating a file in the %temp% directory
Сreating synchronization primitives
Unauthorized injection to a system process
Sending a TCP request to an infection source
Result
Malware family:
n/a
Score:
  9/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/8303/overview
Behaviour
MalwareBazaar
MeasuringTime
CPUID_Instruction
SystemUptime
EvasionQueryPerformanceCounter
EvasionGetTickCount
CheckCmdLine
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
DanaBot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b45434af-1177-419d-a17e-04635bfcaaf0
Result
Threat name:
DanaBot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/951243
Signature
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Yara detected DanaBot stealer dll
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9ff6891ef4465e0a3ee08520c57c133ea47ea72c408c165d2aab578b007fadf9/
Threat name:
Win32.Trojan.Strab
Create hunting rule
Status:
Malicious
First seen:
2022-03-05 16:23:25 UTC
File Type:
PE (Exe)
Extracted files:
40
AV detection:
19 of 27 (70.37%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
0b4784972468b114e8fb957769af4aa76d1f050ef4913296f1a3c412afa5b49e
DanaBot
23229b2ceee2481db7c9e645e849efe08ea77e0a7dff48448d45896f3bd49c0e
DanaBot
576ddf77b8b7a0685f8619125f16bbaebd35b38caf08c5ef6ea19be5a080125b
DanaBot
5cf233d7267a011a4e21064d530fc1b6e80f995b22cf86b29e773d13a463a628
DanaBot
69f4f29d3eb2f05d7b7f4f736375765b7ed97d0948460adb95ad134b1f54a880
DanaBot
6e33bb5afea750c9d310218cf18796b7e1754332684bf92806ccba081bcc5a69
DanaBot
90ac445f282c66552b08d176d123635537170009fa83988ce5011aef18ba5fb9
DanaBot
97a1dadc6e1ccaa807240649c63f175169b0badaf65be530e98ad7790d69fc1e
DanaBot
d5faba20007266314cf176b9e49ccbc35c3fd2b0982fcd73f7b5794539b42e89
DanaBot
d884436a17d35656ddeae1a06103d0b787d9f22851fedba571293898f6fd3645
DanaBot
+ 9'835 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/220305-wzbejaghd3/
Behaviour
Checks processor information in registry
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of SetThreadContext
Blocklisted process makes network request
Unpacked files
SH256 hash:
3367bbb4d4bec62552b5b1c24c7b9cc7607fe4a9a6cbc80f6eb75e1413cf7b0e
MD5 hash:
9d48473b90f7eba68dd62524e23c7f9b
SHA1 hash:
496242345c1e08bb998df4ad8a303c4de2b51aa9
Link:
https://www.unpac.me/results/f8f5dd9e-8cf7-4e85-b236-f2978a9abe5d/
SH256 hash:
9ff6891ef4465e0a3ee08520c57c133ea47ea72c408c165d2aab578b007fadf9
MD5 hash:
546a5a09ff2e43a8b8989321c12cc95f
SHA1 hash:
e6e9dec075e25687291ad4741e374c74f0a60298
Link:
https://www.unpac.me/results/f8f5dd9e-8cf7-4e85-b236-f2978a9abe5d/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9ff6891ef4465e0a3ee08520c57c133ea47ea72c408c165d2aab578b007fadf9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DanaBot

Executable exe 9ff6891ef4465e0a3ee08520c57c133ea47ea72c408c165d2aab578b007fadf9

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2076755/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/247559/

Comments