MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 af757d871c87055b362a777b1884556d0a59af3df2ff9edaf626d5d17939db08. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DanaBot


Vendor detections: 12


Intelligence 12 IOCs YARA 10 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: af757d871c87055b362a777b1884556d0a59af3df2ff9edaf626d5d17939db08
SHA3-384 hash: 7a391762d6367a053688969ae9fc3a8ed95846d11e8cd4893574e2f3629c502fea12c4f19db669fd3fe4c5a15d52978d
SHA1 hash: a66b7838716dd2c6018cde2d0e021e04966e811a
MD5 hash: f21987dd2674aff016c296ba5166256d
humanhash: uncle-purple-mexico-five
File name:af757d871c87055b362a777b1884556d0a59af3df2ff9edaf626d5d17939db08
Download: download sample
Signature DanaBot
Create hunting rule
File size:7'436'085 bytes
First seen:2024-08-22 02:14:31 UTC
Last seen:2024-08-22 02:27:21 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 5ed501feaf5d236dc12d95f1137f7344 (1 x DanaBot)
ssdeep 49152:z5Mn71lMsi2c5M2SL8HoY5XaeD/Pf+oEDBsEcJiaQmF/2azcsASxlFQ4XqXAFsod:QAkQpREtU3
TLSH T154761205BE955DAED91A2434545F53353A781C050833CBE39EBBDD32BE67622AC8E30B
TrID 43.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
22.9% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
9.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.0% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.2% (.EXE) Win32 Executable (generic) (4504/4/1)
Reporter JAMESWT_WT
Tags:204-79-197-203 DanaBot dll

Intelligence

File Origin
# of uploads :
2
# of downloads :
362
Origin country :
IT IT
Vendor Threat Intelligence
Verdict:
Malicious
Score:
97.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66c69f2ae7ff3f5a063bbb03
Tags:
Encryption Variant
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Searching for the window
Creating a window
Searching for synchronization primitives
Creating a file in the %temp% directory
Reading critical registry keys
Using the Windows Management Instrumentation requests
Stealing user critical data
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-debug matanbuchus overlay
Link:
https://www.filescan.io/uploads/66c69f278f9ac9543f325745/reports/bad6864c-545a-4947-84ab-a99f54467288/overview
Verdict:
Malicious
Labled as:
Doina.Generic
Link:
https://www.hybrid-analysis.com/sample/af757d871c87055b362a777b1884556d0a59af3df2ff9edaf626d5d17939db08
Result
Verdict:
MALICIOUS
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/63f3e888-5e31-418b-ad18-79978abf19b3
Result
Threat name:
DanaBot
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/1497103
Signature
AI detected suspicious sample
May use the Tor software to hide its network traffic
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Suricata IDS alerts for network traffic
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Instant Messenger accounts or passwords
Yara detected DanaBot stealer dll
Behaviour
Behavior Graph:
Download SVG
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/af757d871c87055b362a777b1884556d0a59af3df2ff9edaf626d5d17939db08
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/af757d871c87055b362a777b1884556d0a59af3df2ff9edaf626d5d17939db08/
Threat name:
Win32.Trojan.Danabot
Create hunting rule
Status:
Malicious
First seen:
2024-08-08 13:08:32 UTC
AV detection:
11 of 24 (45.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=v52x3by4q4cvwnrko55rrbcvnufftlz56l7z5wxwe3k5c6jz3mea._file
Verdict:
malicious
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery
Link:
https://tria.ge/reports/240822-cpk2faxckj/
Behaviour
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Unpacked files
SH256 hash:
af757d871c87055b362a777b1884556d0a59af3df2ff9edaf626d5d17939db08
MD5 hash:
f21987dd2674aff016c296ba5166256d
SHA1 hash:
a66b7838716dd2c6018cde2d0e021e04966e811a
Link:
https://www.unpac.me/results/60113b00-3d06-47ff-b746-d228b1c8583a/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/af757d871c87/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/af757d871c87055b362a777b1884556d0a59af3df2ff9edaf626d5d17939db08

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Reviews
IDCapabilitiesEvidence
FFI_METHODSCan perform system-level operations via FFI__ZN4core3ptr125drop_in_place$LT$$LP$std::sys::pal::windows::process::EnvKey$C$core::option::Option$LT$std::ffi::os_str::OsString$GT$$RP$$GT$17h28fd21acabdf2932E
__ZN4core3ptr137drop_in_place$LT$alloc::collections::btree::map::BTreeMap$LT$std::sys::pal::windows::process::EnvKey$C$std::ffi::os_str::OsString$GT$$GT$17hcceec4f300da4f24E
__ZN4core3ptr137drop_in_place$LT$alloc::collections::btree::map::IntoIter$LT$std::sys::pal::windows::process::EnvKey$C$std::ffi::os_str::OsString$GT$$GT$17h9cd1d2154e297a3aE
__ZN4core3ptr165drop_in_place$LT$alloc::collections::btree::map::BTreeMap$LT$std::sys::pal::windows::process::EnvKey$C$core::option::Option$LT$std::ffi::os_str::OsString$GT$$GT$$GT$17h968476161d184884E
__ZN4core3ptr165drop_in_place$LT$core::option::Option$LT$alloc::collections::btree::map::BTreeMap$LT$std::sys::pal::windows::process::EnvKey$C$std::ffi::os_str::OsString$GT$$GT$$GT$17ha1b7a4291b28aa56E
__ZN4core3ptr47drop_in_place$LT$std::ffi::os_str::OsString$GT$17h3a6391d5c9319f16E
__ZN4core3ptr70drop_in_place$LT$alloc::vec::Vec$LT$std::ffi::os_str::OsString$GT$$GT$17h4a8bf655b1f10eeaE
__ZN4core3ptr84drop_in_place$LT$$LP$std::ffi::os_str::OsString$C$std::ffi::os_str::OsString$RP$$GT$17h27970b8b56c177e1E
__ZN4core3ptr97drop_in_place$LT$$LP$std::sys::pal::windows::process::EnvKey$C$std::ffi::os_str::OsString$RP$$GT$17h0843b2a9d8fbade1E
__ZN81_$LT$std::ffi::os_str::OsString$u20$as$u20$std::os::windows::ffi::OsStringExt$GT$9from_wide17he50806d45a15867fE
__ZN62_$LT$std::ffi::os_str::Display$u20$as$u20$core::fmt::Debug$GT$3fmt17h1fdc2998d91055d4E
__ZN63_$LT$std::ffi::os_str::OsString$u20$as$u20$core::fmt::Write$GT$9write_str17h08d085580ab735e3E
__ZN3std3ffi6os_str95_$LT$impl$u20$core::convert::TryFrom$LT$$RF$std::ffi::os_str::OsStr$GT$$u20$for$u20$$RF$str$GT$8try_from17h8cf5f1bd14b3a0c2E
__ZN64_$LT$std::ffi::os_str::Display$u20$as$u20$core::fmt::Display$GT$3fmt17h1ee370c62bbe7ac2E
__ZN113_$LT$std::sys::pal::windows::process::EnvKey$u20$as$u20$core::convert::From$LT$std::ffi::os_str::OsString$GT$$GT$4from17h72f3d89c4b5d0415E
__ZN3std3sys3pal7windows7process123_$LT$impl$u20$core::convert::From$LT$std::sys::pal::windows::process::EnvKey$GT$$u20$for$u20$std::ffi::os_str::OsString$GT$4from17hf6a6e8905b50bb54E
__ZN114_$LT$std::sys::pal::windows::process::EnvKey$u20$as$u20$core::convert::From$LT$$RF$std::ffi::os_str::OsStr$GT$$GT$4from17h24481c3a27f60ff4E
__ZN111_$LT$std::sys::pal::windows::process::EnvKey$u20$as$u20$core::convert::AsRef$LT$std::ffi::os_str::OsStr$GT$$GT$6as_ref17h5b9e25e745423cb4E
__ZN60_$LT$std::ffi::os_str::OsStr$u20$as$u20$core::fmt::Debug$GT$3fmt17h59a624e9fc54038dE
__ZN63_$LT$std::ffi::os_str::OsString$u20$as$u20$core::fmt::Debug$GT$3fmt17h9388da13f440685cE
FILE_IO_READCan Read Files__ZN54_$LT$std::fs::Metadata$u20$as$u20$core::fmt::Debug$GT$3fmt17hfaf2ba2c97b740f3E
__ZN75_$LT$std::fs::ReadDir$u20$as$u20$core::iter::traits::iterator::Iterator$GT$4next17he6ae0d0ef536c549E
FILE_IO_WRITECan Create and Remove Files__ZN79_$LT$alloc::vec::Vec$LT$u8$GT$$u20$as$u20$std::io::copy::BufferedWriterSpec$GT$11buffer_size17h1d4e88b8639fb94aE
__ZN54_$LT$std::fs::DirEntry$u20$as$u20$core::fmt::Debug$GT$3fmt17he7540c487b0c8f5aE
__ZN54_$LT$std::fs::FileType$u20$as$u20$core::fmt::Debug$GT$3fmt17hc65c4996f23eb21fE
__ZN57_$LT$std::fs::Permissions$u20$as$u20$core::fmt::Debug$GT$3fmt17hdbce64e972452396E
NET_METHODSUses Network to send and receive data__ZN104_$LT$std::sys_common::net::LookupHost$u20$as$u20$core::convert::TryFrom$LT$$LP$$RF$str$C$u16$RP$$GT$$GT$8try_from17h3e8accfa3f9285c9E
__ZN68_$LT$std::sys_common::net::TcpStream$u20$as$u20$core::fmt::Debug$GT$3fmt17h4c07bfb7eaa7c8edE
__ZN70_$LT$std::sys_common::net::TcpListener$u20$as$u20$core::fmt::Debug$GT$3fmt17h281ac18eb2e95542E
__ZN68_$LT$std::sys_common::net::UdpSocket$u20$as$u20$core::fmt::Debug$GT$3fmt17h6b8a6a6ab38d40a3E
__ZN91_$LT$std::sys_common::net::LookupHost$u20$as$u20$core::iter::traits::iterator::Iterator$GT$4next17h978e33da421876bdE
__ZN74_$LT$std::sys_common::net::LookupHost$u20$as$u20$core::ops::drop::Drop$GT$4drop17h00531a76aa0a66fcE
__ZN90_$LT$std::sys_common::net::LookupHost$u20$as$u20$core::convert::TryFrom$LT$$RF$str$GT$$GT$8try_from17h9211e1cf5d3cbc5bE
__ZN3std10sys_common3net154_$LT$impl$u20$std::sys_common::IntoInner$LT$$LP$std::sys_common::net::SocketAddrCRepr$C$i32$RP$$GT$$u20$for$u20$$RF$core::net::socket_addr::SocketAddr$GT$10into_inner17he1eb0a06bc75feb8E

Comments