MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bd479d266d399cc82669857aef8bf8b108cb5fd42730da6565dd563df022f0a5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	bd479d266d399cc82669857aef8bf8b108cb5fd42730da6565dd563df022f0a5
SHA3-384 hash:	19093c9a3e3d285e92cd85fa52da9191da3f7c5d3050f7687537546cf9ea64fcece1efdd227c334413f396ba27330c5c
SHA1 hash:	0561d9d3d4dfded43cdd3087d8cb7147eab9e4fd
MD5 hash:	ce12de24c0c3b7d34fb03195c3969265
humanhash:	failed-nitrogen-timing-glucose
File name:	bd479d266d399cc82669857aef8bf8b108cb5fd42730da6565dd563df022f0a5
Download:	download sample
Signature	DanaBot Alert Create hunting rule
File size:	18'427'904 bytes
First seen:	2024-08-22 00:31:05 UTC
Last seen:	2024-08-22 01:25:11 UTC
File type:	msi
MIME type:	application/x-msi
ssdeep	393216:HgTZNBsW5aieKUfQ2l+4PEl+R53X+/yTENtOvMXdUEY/X:ATTCW5aiLUfQ2pEly3cNtVXdUt/
TLSH	T1A6073371ABAB5314C0B1263319EE5A34928DBD5CFC930CDEA31DB62824F9BD584F648D
TrID	68.9% (.MST) Windows SDK Setup Transform script (61000/1/5) 22.0% (.WPS) Kingsoft WPS Office document (alt.) (19502/3/2) 9.0% (.) Generic OLE2 / Multistream Compound (8000/1)
Reporter	JAMESWT_WT
Tags:	91-92-242-111 DanaBot msi signed

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

83

Origin country :

IT

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.FileRepMalware.11996.20314.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

81.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=66c68706e7ff3f5a063bb879

Tags:

Generic Stealth

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

fingerprint installer keylogger packed packed

Link:

https://www.filescan.io/uploads/66c687048355227f207360a8/reports/366d2314-c53e-40eb-8752-c15d378bb642/overview

Hybrid Analysis TR/Dldr.Rugmi

Verdict:

Malicious

Labled as:

TR/Dldr.Rugmi

Link:

https://www.hybrid-analysis.com/sample/bd479d266d399cc82669857aef8bf8b108cb5fd42730da6565dd563df022f0a5

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/bd479d266d399cc82669857aef8bf8b108cb5fd42730da6565dd563df022f0a5

Joe Sandbox DanaBot

Result

Threat name:

DanaBot

Alert

Create hunting rule

Detection:

malicious

Classification:

phis.troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1497073

Signature

AI detected suspicious sample

Found suspicious ZIP file

May use the Tor software to hide its network traffic

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

PE file has a writeable .text section

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Suricata IDS alerts for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Instant Messenger accounts or passwords

Yara detected DanaBot stealer dll

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Susipicious

Score:

39%

Verdict:

Susipicious

File Type:

ARCHIVE

Link:

https://malprob.io/report/bd479d266d399cc82669857aef8bf8b108cb5fd42730da6565dd563df022f0a5

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/bd479d266d399cc82669857aef8bf8b108cb5fd42730da6565dd563df022f0a5/

ReversingLabs TitaniumCloud Win32.Trojan.Danabot

Threat name:

Win32.Trojan.Danabot

Alert

Create hunting rule

Status:

Malicious

First seen:

2024-08-07 14:32:02 UTC

File Type:

Binary (Archive)

Extracted files:

1007

AV detection:

9 of 38 (23.68%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xvdz2jtnhgomqjtjqv5o7c7yweemwx6ue4ynuzlf3vld34bc6csq._file

Threatray malicious

Verdict:

malicious

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  6/10

Tags:

discovery persistence privilege_escalation

Link:

https://tria.ge/reports/240822-avmq4syfjf/

Behaviour

Checks SCSI registry key(s)

Enumerates system info in registry

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Volume Shadow Copy service COM API

Browser Information Discovery

Enumerates physical storage devices

Event Triggered Execution: Installer Packages

Program crash

System Location Discovery: System Language Discovery

Drops file in Windows directory

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Blocklisted process makes network request

Enumerates connected drives

Threat.Zone Suspicious

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/273e05b2-54b7-4134-941b-13a613ed5893

VMRay Malicious

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/bd479d266d39/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

0.98

Link:

https://yomi.yoroi.company/submissions/bd479d266d399cc82669857aef8bf8b108cb5fd42730da6565dd563df022f0a5