MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b9f2ce1d3e9f6eb983a8620c4ba52401ef0a74b4ff856e27386840626c30f637. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DanaBot


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b9f2ce1d3e9f6eb983a8620c4ba52401ef0a74b4ff856e27386840626c30f637
SHA3-384 hash: f6ff6743bde1be193910cb0ebfaac8b09687a3e485893ebfe1be0e99343383a15e2ca84f988168ab74a7f9e8f07fdda7
SHA1 hash: 2d97856af7bcf4e0341fd3c7dafd2d8e1b6d88f9
MD5 hash: 21251e40d18b7366c30efacb9f2f45a3
humanhash: video-missouri-black-violet
File name:21251e40d18b7366c30efacb9f2f45a3.exe
Download: download sample
Signature DanaBot
Create hunting rule
File size:1'123'534 bytes
First seen:2021-08-18 17:56:47 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash be41bf7b8cc010b614bd36bbca606973 (195 x LummaStealer, 126 x DanaBot, 63 x Vidar)
ssdeep 24576:Nd1ZroX5NY50ZGu7Iaj1wCAWzlFXDyO83H+ovi1/GpwvPEzUX3F:31ZqG5kLxDA4FXO3BvJlUX3F
TLSH T13B35236193E4107BECA78136043767278B71BE5B92748B2FE394A9ADB8715133C1CB35
dhash icon f2cecc8e86cce892 (6 x DanaBot, 1 x CyberGate, 1 x RemcosRAT)
Reporter abuse_ch
Tags:DanaBot exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
263
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/180416/
Detection(s):
Win.Packed.Filerepmalware-9864117-0
Create hunting rule

Win.Packed.Stop-9872858-0
Create hunting rule

Win.Packed.Doina-9886276-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
IntelRapid
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f7438d91-f501-4c4e-af86-4242816c5c3c
Result
Threat name:
Clipboard Hijacker
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/835281
Signature
Antivirus / Scanner detection for submitted sample
Delayed program exit found
Detected unpacking (changes PE section rights)
Found malware configuration
Machine Learning detection for dropped file
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Obfuscated command line found
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: WScript or CScript Dropper
Submitted sample is a known malware sample
System process connects to network (likely due to code injection or exploit)
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Yara detected Clipboard Hijacker
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 467708 Sample: YExZXHxj8X.exe Startdate: 18/08/2021 Architecture: WINDOWS Score: 100 81 Found malware configuration 2->81 83 Antivirus / Scanner detection for submitted sample 2->83 85 Multi AV Scanner detection for submitted file 2->85 87 6 other signatures 2->87 11 YExZXHxj8X.exe 25 2->11         started        14 SmartClock.exe 2->14         started        16 rundll32.exe 2->16         started        18 SmartClock.exe 2->18         started        process3 file4 61 C:\Users\user\AppData\Local\Temp\...\vps.exe, PE32 11->61 dropped 63 C:\Users\user\AppData\Local\...\fanfa.exe, PE32 11->63 dropped 65 C:\Users\user\AppData\Local\Temp\...\UAC.dll, PE32 11->65 dropped 67 3 other files (none is malicious) 11->67 dropped 20 vps.exe 1 6 11->20         started        23 fanfa.exe 4 11->23         started        process5 file6 89 Multi AV Scanner detection for dropped file 20->89 91 Machine Learning detection for dropped file 20->91 26 cmd.exe 1 20->26         started        29 dllhost.exe 20->29         started        57 C:\Users\user\AppData\...\SmartClock.exe, PE32 23->57 dropped 93 Detected unpacking (changes PE section rights) 23->93 95 Delayed program exit found 23->95 31 SmartClock.exe 23->31         started        signatures7 process8 signatures9 103 Submitted sample is a known malware sample 26->103 105 Obfuscated command line found 26->105 107 Uses ping.exe to sleep 26->107 109 Uses ping.exe to check the status of other devices and networks 26->109 33 cmd.exe 3 26->33         started        36 conhost.exe 26->36         started        process10 signatures11 77 Obfuscated command line found 33->77 79 Uses ping.exe to sleep 33->79 38 Ergendosi.exe.com 33->38         started        41 findstr.exe 1 33->41         started        44 PING.EXE 1 33->44         started        process12 dnsIp13 101 May check the online IP address of the machine 38->101 47 Ergendosi.exe.com 3 18 38->47         started        59 C:\Users\user\AppData\...rgendosi.exe.com, Targa 41->59 dropped 71 192.168.2.4, 443, 49257, 49683 unknown unknown 44->71 file14 signatures15 process16 dnsIp17 73 ip-api.com 208.95.112.1, 49743, 80 TUT-ASUS United States 47->73 75 nNpwxhwvUw.nNpwxhwvUw 47->75 55 C:\Users\user\AppData\...\msskikeqgmh.vbs, ASCII 47->55 dropped 51 wscript.exe 12 47->51         started        file18 process19 dnsIp20 69 iplogger.org 88.99.66.31, 443, 49750 HETZNER-ASDE Germany 51->69 97 System process connects to network (likely due to code injection or exploit) 51->97 99 May check the online IP address of the machine 51->99 signatures21
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b9f2ce1d3e9f6eb983a8620c4ba52401ef0a74b4ff856e27386840626c30f637/
Threat name:
Win32.Ransomware.StopCrypt
Create hunting rule
Status:
Malicious
First seen:
2021-08-18 17:57:05 UTC
AV detection:
13 of 28 (46.43%)
Threat level:
  5/5
Result
Malware family:
danabot
Create hunting rule
Score:
  10/10
Tags:
family:danabot botnet:4 banker discovery persistence spyware stealer trojan
Link:
https://tria.ge/reports/210818-ekf61aphas/
Behaviour
Checks processor information in registry
Modifies registry class
Modifies system certificate store
Runs ping.exe
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Suspicious use of SetThreadContext
Adds Run key to start application
Checks installed software on the system
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Drops startup file
Loads dropped DLL
Reads user/profile data of web browsers
Blocklisted process makes network request
Downloads MZ/PE file
Executes dropped EXE
Danabot
Danabot Loader Component
Malware Config
C2 Extraction:
23.229.29.48:443
152.89.247.31:443
192.210.222.81:443
Unpacked files
SH256 hash:
cae2af36f866fed9753ecc423bf1cfb3d1b5f2c3179dddc1715d6c896812d669
MD5 hash:
0fcc3d7408dfb7b31d8e36982dab298c
SHA1 hash:
6ebe13e8565ab5cfc7f8eac8973c156531b2a1e2
Link:
https://www.unpac.me/results/a4cbbabc-a736-4cde-8b86-3c7b1ced07ee/
SH256 hash:
9fa9a6bdf5f5e4d3b778a6596017d9126b4bb9dc20acf8ad979ef6e4a107ca44
MD5 hash:
4df95e0e5d3473d11409d5de60d5f639
SHA1 hash:
964013118d598195f3290e273c45ee6e1325a79d
Link:
https://www.unpac.me/results/a4cbbabc-a736-4cde-8b86-3c7b1ced07ee/
SH256 hash:
246bfa7e6a5a8b4eec2c0c149c05abcc5a239fe8e2d362d4caab7fe1296b720f
MD5 hash:
c4feda28cb6a0b091448fce36452b85a
SHA1 hash:
092d93f82294f32bb1085ef646235a8da410a58d
Link:
https://www.unpac.me/results/a4cbbabc-a736-4cde-8b86-3c7b1ced07ee/
SH256 hash:
b9f2ce1d3e9f6eb983a8620c4ba52401ef0a74b4ff856e27386840626c30f637
MD5 hash:
21251e40d18b7366c30efacb9f2f45a3
SHA1 hash:
2d97856af7bcf4e0341fd3c7dafd2d8e1b6d88f9
Link:
https://www.unpac.me/results/a4cbbabc-a736-4cde-8b86-3c7b1ced07ee/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b9f2ce1d3e9f6eb983a8620c4ba52401ef0a74b4ff856e27386840626c30f637

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DanaBot

Executable exe b9f2ce1d3e9f6eb983a8620c4ba52401ef0a74b4ff856e27386840626c30f637

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1543943/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/180416/

Comments