MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a9302bf572c03605650aa7ea9f61bb43f8c6a808b4f335b674e59e8d42add848. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DanaBot


Vendor detections: 10


Intelligence 10 IOCs YARA 14 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a9302bf572c03605650aa7ea9f61bb43f8c6a808b4f335b674e59e8d42add848
SHA3-384 hash: 70f7eea6834f6fedc31b5b8946c17703b77127f58c95d50dda8212ef7f55f148c4d6d1bd29b4f85ec5d5eb2c330efa5d
SHA1 hash: 6df62a76ef23eaa6e726618b875c96812affeb5a
MD5 hash: 6e4dca89801fa708a3f8cd941f84db00
humanhash: single-ceiling-harry-yellow
File name:6e4dca89801fa708a3f8cd941f84db00.exe
Download: download sample
Signature DanaBot
Create hunting rule
File size:6'160'384 bytes
First seen:2021-03-30 06:51:51 UTC
Last seen:2021-03-30 08:00:55 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 0b2d64e32e1e433baaaf8d1bfae5e63e (1 x DanaBot)
ssdeep 98304:pnTI1fZzAQqip/t70ye453w2VFbKQkQSZZfTvQRL57ume8EWtAoNb+1Pspqf84kV:pnTIXztFzvafZFTqL5isRN65sEU4XO
Threatray 44 similar samples on MalwareBazaar
TLSH 9D563300B6A0C4BBD9AA7AB5507253E2C911FC83673CF7DB875AAF3C16241C9463BB15
Reporter abuse_ch
Tags:DanaBot exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
366
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
MainFile-v18.4.29.exe
Verdict:
Malicious activity
Analysis date:
2021-03-29 13:46:04 UTC
Tags:
autoit stealer trojan loader evasion
Link:
https://app.any.run/tasks/ffde19fa-cd36-4385-9917-117dc172db65

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
DanaBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/127909/
Detection(s):
SecuriteInfo.com.Trojan.Siggen12.61187.13620.10611.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Creating a file
Launching a process
Creating a process with a hidden window
Changing a file
Modifying an executable file
Creating a file in the %temp% directory
Sending a custom TCP request
Reading critical registry keys
Forced system process termination
Infecting executable files
Unauthorized injection to a system process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/60c9f6f4-576f-491e-b441-405458283c12
Result
Threat name:
DanaBot
Create hunting rule
Detection:
malicious
Classification:
spre.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/658033
Signature
Antivirus / Scanner detection for submitted sample
Bypasses PowerShell execution policy
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Infects executable files (exe, dll, sys, html)
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal browser information (history, passwords, etc)
Uses nslookup.exe to query domains
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected DanaBot stealer dll
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 377946 Sample: 0f0mccRNrP.exe Startdate: 30/03/2021 Architecture: WINDOWS Score: 100 58 Antivirus / Scanner detection for submitted sample 2->58 60 Multi AV Scanner detection for dropped file 2->60 62 Multi AV Scanner detection for submitted file 2->62 64 3 other signatures 2->64 9 0f0mccRNrP.exe 1 2->9         started        process3 file4 50 C:\Users\user\Desktop\0F0MCC~1.EXE.dll, PE32 9->50 dropped 74 Detected unpacking (changes PE section rights) 9->74 76 Detected unpacking (overwrites its own PE header) 9->76 13 rundll32.exe 9->13         started        16 WerFault.exe 20 9 9->16         started        signatures5 process6 file7 78 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 13->78 80 Bypasses PowerShell execution policy 13->80 82 Uses schtasks.exe or at.exe to add and modify task schedules 13->82 19 rundll32.exe 8 23 13->19         started        44 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 16->44 dropped signatures8 process9 dnsIp10 56 192.3.26.107, 443, 49708 AS-COLOCROSSINGUS United States 19->56 46 C:\Users\user\AppData\Local\...\setup.exe, PE32+ 19->46 dropped 48 C:\Users\user\AppData\...\tmp36D7.tmp.ps1, ASCII 19->48 dropped 66 System process connects to network (likely due to code injection or exploit) 19->66 68 Tries to harvest and steal browser information (history, passwords, etc) 19->68 70 Infects executable files (exe, dll, sys, html) 19->70 24 powershell.exe 16 19->24         started        27 powershell.exe 16 19->27         started        29 schtasks.exe 19->29         started        31 schtasks.exe 19->31         started        file11 signatures12 process13 signatures14 72 Uses nslookup.exe to query domains 24->72 33 nslookup.exe 1 24->33         started        36 conhost.exe 24->36         started        38 conhost.exe 27->38         started        40 conhost.exe 29->40         started        42 conhost.exe 31->42         started        process15 dnsIp16 52 localhost 33->52 54 8.8.8.8.in-addr.arpa 33->54
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a9302bf572c03605650aa7ea9f61bb43f8c6a808b4f335b674e59e8d42add848/
Threat name:
Win32.Trojan.Azorult
Create hunting rule
Status:
Malicious
First seen:
2021-03-30 00:51:49 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=veycx5lsya3akziku7vj6yn3ip4mnkaiwtztlntu4wpi2qvn3bea._file
Verdict:
malicious
Similar samples:
0aeca92ed74184da2c9450b3de78013045e0b0800c206899d97298765a03b788
DanaBot
0bd3e2289f0899ce7978056ad9a96bc1f33e37bb219ecd19ccd0e64b993f6143
DanaBot
4a65ddca4c97868fc0309493751540040a3867c1ef116e84f3458b0a894412b5
DanaBot
5288d023c4a8127ed105f7d8b9142aab47dc505efc5b6a81e8c9367f0465c03a
DanaBot
57357b402876a772f39631c930062011532774d893b69eb9c66ee3b1d3867b1a
DanaBot
6b5ac8a36a41a1220a049752119417478afd1ac433ac5b2da0e7c9560b38c52e
DanaBot
7662ab9b318424d7a2351788c64a08788f5c7e12ca960b199d737fd883fe7d40
DanaBot
bae80042c1b61aa70ea8687213f90a6326de60f5999e5ecd8d4dd41c7361d16b
DanaBot
e1043b597d99a6553919b8e0d8e265aa6dd2f2004d63c57686d3e4dfca13505e
DanaBot
e3e6925c2542dfef5760150b07bc591324b8287fd829766ab1d938b5ed1ebecc
DanaBot
+ 34 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/210330-k64k7lym3a/
Unpacked files
SH256 hash:
b96c0185526f60f5e0631c4f73a99ef3b4367586a450749fbc900daea91f6c7e
MD5 hash:
e35744f9933b37413a01f0e1ed44e8dc
SHA1 hash:
103dcba09fff40713505a817776cec8e193ae151
Link:
https://www.unpac.me/results/490dcd06-4458-409a-b5e6-6cb55ff4ae73/
SH256 hash:
e2e79ea3ba2ad91155a5edc6adf2f3e07facdf7bf5d064b1d492282654f954c9
MD5 hash:
a02f4f4d482feae676db585a6b1826f1
SHA1 hash:
2286ff3ef0aa38bbd6b0de67d00150b6d17c2a9f
Link:
https://www.unpac.me/results/490dcd06-4458-409a-b5e6-6cb55ff4ae73/
SH256 hash:
f9f8b2a0c1f264ea0cf3ab9a7bfe03a2154b09c04b4e79891df1dbfa68469fa4
MD5 hash:
bae44b867c951c0ab1c54444bdbf545f
SHA1 hash:
45160a916751074883131fb731144811d3282d7f
Link:
https://www.unpac.me/results/490dcd06-4458-409a-b5e6-6cb55ff4ae73/
SH256 hash:
a9302bf572c03605650aa7ea9f61bb43f8c6a808b4f335b674e59e8d42add848
MD5 hash:
6e4dca89801fa708a3f8cd941f84db00
SHA1 hash:
6df62a76ef23eaa6e726618b875c96812affeb5a
Link:
https://www.unpac.me/results/490dcd06-4458-409a-b5e6-6cb55ff4ae73/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a9302bf572c03605650aa7ea9f61bb43f8c6a808b4f335b674e59e8d42add848

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Email_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Email in files like avemaria
Rule name:hunt_skyproj_backdoor
Create hunting rule
Author:SBousseaden
Reference:https://unit42.paloaltonetworks.com/unit42-prince-persia-ride-lightning-infy-returns-foudre/
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many file transfer clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_Messaging_Clients
Create hunting rule
Author:@ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
Author:ditekSHen
Description:Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Rule name:INDICATOR_SUSPICIOUS_PWSH_PasswordCredential_RetrievePasswor
Create hunting rule
Author:ditekSHen
Description:Detects PowerShell content designed to retrieve passwords from host
Rule name:INDICATOR_SUSPICIOUS_PWSH_PasswordCredential_RetrievePassword
Create hunting rule
Author:ditekSHen
Description:Detects PowerShell content designed to retrieve passwords from host
Rule name:Keylog_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Contains Keylog
Rule name:MALWARE_Win_DanaBot
Create hunting rule
Author:ditekSHen
Description:Detects DanaBot variants
Rule name:Ping_Del_method_bin_mem
Create hunting rule
Author:James_inthe_box
Description:cmd ping IP nul del
Rule name:Select_from_enumeration
Create hunting rule
Author:James_inthe_box
Description:IP and port combo
Rule name:Stealer_word_in_memory
Create hunting rule
Author:James_inthe_box
Description:The actual word stealer in memory
Rule name:with_sqlite
Create hunting rule
Author:Julian J. Gonzalez <info@seguridadparatodos.es>
Description:Rule to detect the presence of SQLite data in raw image
Reference:http://www.st2labs.com

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DanaBot

Executable exe a9302bf572c03605650aa7ea9f61bb43f8c6a808b4f335b674e59e8d42add848

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1096421/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/127909/

Comments