🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b6e2dcddf2c2b5ed16db6c0d63ddd9aee550666e347c6aabb9e278fd839ae240. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DanaBot


Vendor detections: 9


Intelligence 9 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b6e2dcddf2c2b5ed16db6c0d63ddd9aee550666e347c6aabb9e278fd839ae240
SHA3-384 hash: 412b77648dd3d3d4941d5af5be58132e87390e299cd54351e2017ae65d8a341770352e63726cbb07a8e51d845e3cc47c
SHA1 hash: adf9c54bcc31cdc45ceea8bc8ade56e55de71121
MD5 hash: 4b9d0eec327ee2422af8e720fc33dee3
humanhash: eleven-ink-don-ink
File name:4b9d0eec327ee2422af8e720fc33dee3.dll
Download: download sample
Signature DanaBot
Create hunting rule
File size:1'399'296 bytes
First seen:2022-04-13 20:01:51 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash f9e81afd2870aaecd8ace36b2893b1d3 (10 x DanaBot)
ssdeep 24576:RcF2ddLBEH/yuGeb3+yPbduheDDx0OJ1KTPWi+D:SQ3yhugD2Tu5D
Threatray 1 similar samples on MalwareBazaar
TLSH T11B557E22B2C8F53ED0E90B3A4967A744543F7B31A6559C2F57E048CCCE2A2C11A7676F
Reporter abuse_ch
Tags:DanaBot dll


Avatar
abuse_ch
DanaBot C2:
104.168.148.6:443

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
104.168.148.6:443 https://threatfox.abuse.ch/ioc/519148/

Intelligence

File Origin
# of uploads :
1
# of downloads :
699
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/263515/
Detection(s):
Win.Malware.Danabot-9888646-0
Create hunting rule

Win.Malware.Danabot-9888889-0
Create hunting rule

Win.Malware.Danabot-9888971-0
Create hunting rule

Win.Malware.Danabot-9888977-0
Create hunting rule

Win.Malware.Danabot-9888984-0
Create hunting rule

Win.Malware.Danabot-9889011-0
Create hunting rule

Win.Malware.Danabot-9889205-0
Create hunting rule

Win.Malware.Danabot-9889874-0
Create hunting rule

Win.Malware.Danabot-9889875-0
Create hunting rule

Win.Trojan.Danabot-9888571-0
Create hunting rule

Win.Trojan.Danabot-9889991-0
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a custom TCP request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
aspnet_compiler.exe csc.exe evasive expand.exe fltmc.exe ieexec.exe odbcconf.exe replace.exe shdocvw.dll
Link:
https://www.filescan.io/uploads/62572c3deab80a7a6c0c6400/reports/6da40b50-fef0-4b77-9a6b-6a7bc8637d4c/overview
Malware family:
DanaBot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a1ea39a0-c8e6-452d-b551-cb47e4b1c1c0
Result
Threat name:
DanaBot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/976444
Signature
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Sigma detected: Suspicious Call by Ordinal
System process connects to network (likely due to code injection or exploit)
Yara detected DanaBot stealer dll
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 608931 Sample: PVkZdr411m.dll Startdate: 13/04/2022 Architecture: WINDOWS Score: 76 23 Antivirus / Scanner detection for submitted sample 2->23 25 Multi AV Scanner detection for submitted file 2->25 27 Yara detected DanaBot stealer dll 2->27 29 Sigma detected: Suspicious Call by Ordinal 2->29 7 loaddll32.exe 2 2->7         started        process3 process4 9 rundll32.exe 1 7->9         started        12 rundll32.exe 1 7->12         started        15 cmd.exe 1 7->15         started        17 rundll32.exe 1 7->17         started        dnsIp5 31 System process connects to network (likely due to code injection or exploit) 9->31 21 104.168.148.6, 443, 49742, 49743 HOSTWINDSUS United States 12->21 19 rundll32.exe 1 15->19         started        signatures6 process7
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b6e2dcddf2c2b5ed16db6c0d63ddd9aee550666e347c6aabb9e278fd839ae240/
Threat name:
Win32.Trojan.DanaBot
Create hunting rule
Status:
Malicious
First seen:
2022-04-13 20:02:09 UTC
File Type:
PE (Dll)
AV detection:
23 of 26 (88.46%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=w3rnzxpsyk262fw3nqgwhxozv3svaztogr6gvk5z4j4p3a424jaa._file
Verdict:
malicious
Similar samples:
2a3acdcd76575762b18c18c644a745125f55ce121f742d2aad962521bc7f25fd
DanaBot
Result
Malware family:
danabot
Create hunting rule
Score:
  10/10
Tags:
family:danabot botnet:4 banker suricata trojan
Link:
https://tria.ge/reports/220413-yr36paffgk/
Behaviour
Suspicious use of WriteProcessMemory
Blocklisted process makes network request
Danabot
suricata: ET MALWARE Danabot Key Exchange Request
Malware Config
C2 Extraction:
104.168.148.6:443
5.9.224.204:443
192.210.222.81:443
23.229.29.48:443
Unpacked files
SH256 hash:
21c6e450d4f5756fc1a94634b0bce61a70f722e88fe620d90dc894f2b18c5354
MD5 hash:
8fc958c50b9d11d920a02dff6f3b02c2
SHA1 hash:
ec8f7c80e6e5970a13bdb01fee237d83f5fa9359
Link:
https://www.unpac.me/results/c65a8339-4732-4c66-af76-1a169e11d6ba/
SH256 hash:
b6e2dcddf2c2b5ed16db6c0d63ddd9aee550666e347c6aabb9e278fd839ae240
MD5 hash:
4b9d0eec327ee2422af8e720fc33dee3
SHA1 hash:
adf9c54bcc31cdc45ceea8bc8ade56e55de71121
Link:
https://www.unpac.me/results/c65a8339-4732-4c66-af76-1a169e11d6ba/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b6e2dcddf2c2b5ed16db6c0d63ddd9aee550666e347c6aabb9e278fd839ae240

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/263515/

Comments