MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ba3478006a8f45f9979a6f2f363933093cd063f7845c85dc604c374481347c20. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DanaBot


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ba3478006a8f45f9979a6f2f363933093cd063f7845c85dc604c374481347c20
SHA3-384 hash: a2c8ca8a7f857b662594a59762a261ebce0dd02d7d915d87003808453dbe20f1fa730ee776db863d82394790d6841523
SHA1 hash: c3ab4a02f2b9f53964d6ac8d26fd65f2a9bfa80f
MD5 hash: 1e1cddbcfb56b0f20604fa6db7c9d8b4
humanhash: pip-leopard-wolfram-queen
File name:1e1cddbcfb56b0f20604fa6db7c9d8b4.exe
Download: download sample
Signature DanaBot
Create hunting rule
File size:2'791'936 bytes
First seen:2020-06-02 07:04:39 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 958c1dee9689b50076023ade07b084fd (1 x DanaBot)
ssdeep 49152:gpj+c0H79HQNwNjYn2zDX8+YQTFnJBjLEQ+DnFyOsZKkl+OI7SOpMYVb:E50b9HJYnObhYg8R/Fk837Fmu
Threatray 69 similar samples on MalwareBazaar
TLSH E4D523007BE0C434F0B79A75896683E9E82C7AB09F1495EB36C4239F5EB97E59C30752
Reporter abuse_ch
Tags:DanaBot exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
842
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Mbt
Create hunting rule
Status:
Malicious
First seen:
2020-06-01 22:20:20 UTC
File Type:
PE (Exe)
Extracted files:
45
AV detection:
17 of 31 (54.84%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xi2hqadkr5c7tf42n4xtmojtbe6nay7xqroilxdajq3ujajupqqa._file
Verdict:
malicious
Similar samples:
1464f141847f0ee9af9f7f2eda69ebcb56022ae8b1d259bb152a873d3c6a303d
DanaBot
3e6c762ae623b985932a24c99a901dfb7dcb7c452bd5668bf2d7e8883f99381f
DanaBot
4f9b6310c363bc29667d6624f373a78762061fe952494a242454be6550c374da
DanaBot
5128943bdbc08a1f56d6ca3c7be3ac65e7080341a2268c55e4280cee005505c0
DanaBot
95a90fbde8c6cc25ac3ebbc1bc9602a8a656a6c6d29e47378cca197c7018df02
DanaBot
98c2f70c665efdfe6ff95460c0c8f131e80de91cf6dcbcf8bb4209c330280262
DanaBot
991c4166a2246ca5ae9186a1e747f5eb767fdbd304dbfa1c5f4a2019cb6b4aec
DanaBot
9d96347ba7dd239d6a6b667242965905d6e96114281cd7a18812e901712a8303
DanaBot
a59a10879e0a2db88c6ea80f31a85962b7e4e89b6e2c4d4cac459b1580422b78
DanaBot
cd38592468e54623dc5c89529203dbc21ede6cfe95523d2f146449019288038c
DanaBot
+ 59 additional samples on MalwareBazaar
Result
Malware family:
danabot
Create hunting rule
Score:
  10/10
Tags:
family:danabot banker botnet trojan
Link:
https://tria.ge/reports/201109-at81kxs8cs/
Behaviour
Suspicious use of WriteProcessMemory
Loads dropped DLL
Blacklisted process makes network request
Danabot
Danabot x86 payload
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_danabot_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DanaBot

Executable exe ba3478006a8f45f9979a6f2f363933093cd063f7845c85dc604c374481347c20

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/367844/
  
Delivery method
Distributed via web download

Comments