MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b201c8657c45c97a017d357f7542d2786fac1e9cde1a4ce8c5c2021f52e83540. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DanaBot


Vendor detections: 11


Intelligence 11 IOCs YARA 1 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b201c8657c45c97a017d357f7542d2786fac1e9cde1a4ce8c5c2021f52e83540
SHA3-384 hash: cf2da718197972a64e9ff22a348ed121907b48fec42fdd751f693fa7294a1cf0a17370a3a1fe0a388bf87c1207b3ff1b
SHA1 hash: 34726a44b3369b3d741db82c9571d80a15176f54
MD5 hash: 2b16b974325b5aa01406993d40ac15a3
humanhash: mountain-papa-carolina-stream
File name:2b16b974325b5aa01406993d40ac15a3
Download: download sample
Signature DanaBot
Create hunting rule
File size:1'175'040 bytes
First seen:2021-08-01 20:10:03 UTC
Last seen:2021-08-01 20:54:12 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 93a0ca4b4569eae2a4959be5cfc00df3 (1 x DanaBot, 1 x RaccoonStealer)
ssdeep 24576:8zSJofHpHEd3bpCUA5HmD//3h3rL3pUB2bLfsf5N:dWpHEdLpC15HQ/pbTaB2bL
Threatray 3'246 similar samples on MalwareBazaar
TLSH T186452322FD40C4B2C09046306481D7A56FF9AC22A6B087476794667F5FF31D2A1AEE3F
dhash icon 48b9b2b4e8c38890 (11 x RaccoonStealer, 5 x DanaBot, 4 x RedLineStealer)
Reporter zbetcheckin
Tags:32 DanaBot exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
1'093
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
2b16b974325b5aa01406993d40ac15a3
Verdict:
Malicious activity
Analysis date:
2021-08-01 20:12:52 UTC
Tags:
installer trojan danabot
Link:
https://app.any.run/tasks/146bcbf3-5d17-4fb4-95b3-ff47229ec83c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
BlackRAT
Create hunting rule
Link:
https://www.capesandbox.com/analysis/175597/
Detection(s):
SecuriteInfo.com.Trojan.Win32.Save.a.1801.31142.UNOFFICIAL
Create hunting rule

Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Creating a file
Enabling the 'hidden' option for recently created files
Launching a process
Creating a process with a hidden window
Sending a UDP request
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/bef53d28-8a82-46b2-afa8-5a6fe0fffe06
Result
Threat name:
DanaBot
Create hunting rule
Detection:
malicious
Classification:
bank.troj.adwa.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/825161
Signature
Bypasses PowerShell execution policy
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Enables a proxy for the internet explorer
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sets a proxy for the internet explorer
Sigma detected: Suspicious Script Execution From Temp Folder
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal browser information (history, passwords, etc)
Uses nslookup.exe to query domains
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected DanaBot stealer dll
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 457573 Sample: 2uOGKGZ30i Startdate: 01/08/2021 Architecture: WINDOWS Score: 100 56 Found malware configuration 2->56 58 Multi AV Scanner detection for dropped file 2->58 60 Multi AV Scanner detection for submitted file 2->60 62 4 other signatures 2->62 9 2uOGKGZ30i.exe 1 2->9         started        process3 file4 44 C:\Users\user\Desktop\2UOGKG~1.EXE.tmp, PE32 9->44 dropped 74 Detected unpacking (changes PE section rights) 9->74 76 Detected unpacking (overwrites its own PE header) 9->76 13 rundll32.exe 2 9->13         started        signatures5 process6 dnsIp7 50 142.11.244.124, 443, 49712, 49730 HOSTWINDSUS United States 13->50 78 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 13->78 80 Bypasses PowerShell execution policy 13->80 82 Uses schtasks.exe or at.exe to add and modify task schedules 13->82 17 rundll32.exe 10 24 13->17         started        signatures8 process9 dnsIp10 46 127.0.0.1 unknown unknown 17->46 48 192.168.2.1 unknown unknown 17->48 42 C:\Users\user\AppData\...\tmpD220.tmp.ps1, ASCII 17->42 dropped 64 System process connects to network (likely due to code injection or exploit) 17->64 66 Tries to harvest and steal browser information (history, passwords, etc) 17->66 68 Sets a proxy for the internet explorer 17->68 70 Enables a proxy for the internet explorer 17->70 22 powershell.exe 14 17->22         started        25 powershell.exe 17 17->25         started        27 schtasks.exe 1 17->27         started        29 schtasks.exe 1 17->29         started        file11 signatures12 process13 signatures14 72 Uses nslookup.exe to query domains 22->72 31 nslookup.exe 1 22->31         started        34 conhost.exe 22->34         started        36 conhost.exe 25->36         started        38 conhost.exe 27->38         started        40 conhost.exe 29->40         started        process15 dnsIp16 52 localhost 31->52 54 8.8.8.8.in-addr.arpa 31->54
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b201c8657c45c97a017d357f7542d2786fac1e9cde1a4ce8c5c2021f52e83540/
Threat name:
Win32.Trojan.Hynamer
Create hunting rule
Status:
Malicious
First seen:
2021-08-01 19:07:16 UTC
AV detection:
18 of 27 (66.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wia4qzl4ixexual5gv7xkqwspbx2yhu43ynez2gfyibb6uxigvaa._file
Verdict:
malicious
Similar samples:
0705af99615fdc12025b5449cb80591559a3f7a31037cd85dcc64ed0f7224fdc
DanaBot
1a7f51c4e1cd935526684521fb7890dde315dfd49b4b681044f8b14c6a7c88a0
DanaBot
1f1a3e39c44beff5d0cec8d70471ba7c0976e6e80825fde87bff38d6f7285c6d
DanaBot
2f13aeda87ac36d7d1ed671093fb1c713eebba7c3536ccf44486aad6ae679450
DanaBot
40edb22b5967cfeb7b56ff2bd41a97fdeabbfd2a2cb7c7b2020c402f2274e325
DanaBot
641ddfbeb79686d53e97f99b043550cde7d19ef91c6e611f02ad80f33daaf4ad
DanaBot
6695e657eb4222667327f2491e831ec37ea3910fb90fc0a1d73e2e272eab95dc
DanaBot
750e38bbaba907ed33434c5a10119773f1d73dba4d6c624d16bc1bc2dfacac46
DanaBot
9610051a347d56ae5d91e3a3c471a2d90b5a4e02b2aa714f931d4cbe164eb42c
DanaBot
f5fe7311025d620bccb08dcfb69f03c71620351b35ea8635b798ffc62374423a
DanaBot
+ 3'236 additional samples on MalwareBazaar
Result
Malware family:
danabot
Create hunting rule
Score:
  10/10
Tags:
family:danabot botnet:4 banker discovery spyware stealer trojan
Link:
https://tria.ge/reports/210801-rvkq9vx1r2/
Behaviour
Checks processor information in registry
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Checks installed software on the system
Loads dropped DLL
Reads user/profile data of web browsers
Blocklisted process makes network request
Danabot
Malware Config
C2 Extraction:
142.11.244.124:443
142.11.206.50:443
Unpacked files
SH256 hash:
dbf7ee1c646a64f9b4aea4b4180b15a91fa4e31b7e35bb2ed2a3e65301db98d6
MD5 hash:
fc55d7afa5ad97587a0d02965e69501b
SHA1 hash:
e485195a77d6ac84189da82c088698e3118d01bb
Link:
https://www.unpac.me/results/b62c1fa4-4519-408f-8542-e155ea100c42/
SH256 hash:
842ada74f3ea1a3bf0c3a119064a4fc451508b67a1ea9a807a63a5165415f303
MD5 hash:
7091c05b36b65b26d9c4fdbcc8a3f6ab
SHA1 hash:
39505db0d6e61ba060db05f78404fa8ff1b471d1
Link:
https://www.unpac.me/results/b62c1fa4-4519-408f-8542-e155ea100c42/
SH256 hash:
b201c8657c45c97a017d357f7542d2786fac1e9cde1a4ce8c5c2021f52e83540
MD5 hash:
2b16b974325b5aa01406993d40ac15a3
SHA1 hash:
34726a44b3369b3d741db82c9571d80a15176f54
Link:
https://www.unpac.me/results/b62c1fa4-4519-408f-8542-e155ea100c42/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b201c8657c45c97a017d357f7542d2786fac1e9cde1a4ce8c5c2021f52e83540

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:danaBot
Create hunting rule
Author:@is_henderson
Description:DanaBot/BlackRAT Deobfuscated Strings
Reference:https://capesandbox.com/analysis/175597/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DanaBot

Executable exe b201c8657c45c97a017d357f7542d2786fac1e9cde1a4ce8c5c2021f52e83540

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/175597/
  
URLhaus
https://urlhaus.abuse.ch/url/1467030/
  
URLhaus
https://urlhaus.abuse.ch/url/1490082/
  
URLhaus
https://urlhaus.abuse.ch/url/1461110/
  
URLhaus
https://urlhaus.abuse.ch/url/1495647/

Comments


Avatar
zbet commented on 2021-08-01 20:10:04 UTC

url : hxxp://162.223.91.111/cvhost.exe