MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 be62bd296d68f4ffcdb03f51859d8a10cab786435812842679e594564ebafe5f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DanaBot


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: be62bd296d68f4ffcdb03f51859d8a10cab786435812842679e594564ebafe5f
SHA3-384 hash: b490f9017109925531d00d43abddc3cf9b8d5c661c8f6f89fe56e9a04ea3e54464d5e285db832f51b85c5846beeb2de4
SHA1 hash: e992cdf00c2eb2b44d001a2c7511b7768bc35554
MD5 hash: 7927f5cb81ae68172215ab93c41f2b99
humanhash: fish-monkey-friend-asparagus
File name:7927f5cb81ae68172215ab93c41f2b99.exe
Download: download sample
Signature DanaBot
Create hunting rule
File size:1'164'288 bytes
First seen:2021-10-01 06:47:46 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash d31cc935cd1c6935cd48a10ef09a7414 (4 x RaccoonStealer, 3 x RedLineStealer, 2 x ArkeiStealer)
ssdeep 24576:lTBX6ydJdX3C3wb3ZeGjZSyqCKigxM4DfRm0JeMCnN:loydH3C3mpeESZigGgfYacnN
Threatray 5'794 similar samples on MalwareBazaar
TLSH T106451210A2E0C031F6F616FA48BE937A611D7B719B34D8CB16D157EA5AB52F0AC31387
File icon (PE):PE icon
dhash icon e8f8e8e8aa66a499 (5 x RaccoonStealer, 4 x ArkeiStealer, 3 x RedLineStealer)
Reporter abuse_ch
Tags:DanaBot exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
195
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
7927f5cb81ae68172215ab93c41f2b99.exe
Verdict:
Malicious activity
Analysis date:
2021-10-01 06:54:14 UTC
Tags:
trojan danabot
Link:
https://app.any.run/tasks/1241d4d1-ba01-4eaf-91ef-782074c516e8

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
DanaBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/193890/
Detection(s):
SecuriteInfo.com.Trojan.DownLoader42.62977.1394.9336.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file
Enabling the 'hidden' option for recently created files
Launching a process
Creating a process with a hidden window
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d59be455-adcc-40c7-9e37-bea2347ce48d
Result
Threat name:
DanaBot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/862543
Signature
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Yara detected DanaBot stealer dll
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/be62bd296d68f4ffcdb03f51859d8a10cab786435812842679e594564ebafe5f/
Threat name:
Win32.Trojan.Fragtor
Create hunting rule
Status:
Malicious
First seen:
2021-10-01 05:00:51 UTC
AV detection:
25 of 45 (55.56%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xzrl2klnnd2p7tnqh5iylhmkcdflpbsdlajiijtz4wkfmtv27zpq._file
Verdict:
malicious
Similar samples:
16488f2d0899cbedb655bf711c2f0f56ee39d7122d513efd2d1892a459ac430b
DanaBot
28de63cf9d4273527e534ea9b07c5b9434960dd8ffc169323e6580c356568026
DanaBot
3b7f499b7b1bce49129c2ba5ee171153a474fe12670a991580ec2aade4e02f20
DanaBot
596e82d24c64a373095159ee769df582d6f34fde24eb537aca442d8f01c491db
DanaBot
6b10c55482a12c0302f16cd63bd73cd71c105d5dc4bd5d6756cf7656c2c6af69
DanaBot
786b9cb2fa5e78e4bc0d9e67e6f90c0229b150bacfd3e75cf46a9c3a67d57a67
DanaBot
8f71fca5621ccb7ba3558cfebc17014d27923d1c73ad97ececb577fd5b937047
DanaBot
8fa3eaa46c7d8d1f44a2eeca895f802f2aa7a2251bab347ccb765c72d63ccb58
DanaBot
ac23c1754b63e3d1ada2fb36b4a2afa0f6b3fd13b8b90fefecd1bf5b4cdf3adf
DanaBot
d158afc32c31573efe9e0d25404b94a2ebf29e8abe352d67e9e7b2378028bd6b
DanaBot
+ 5'784 additional samples on MalwareBazaar
Result
Malware family:
danabot
Create hunting rule
Score:
  10/10
Tags:
family:danabot banker trojan
Link:
https://tria.ge/reports/211001-hkshlsbaf3/
Behaviour
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Loads dropped DLL
Blocklisted process makes network request
Danabot
Danabot Loader Component
Malware Config
C2 Extraction:
142.11.192.232:443
192.119.110.73:443
142.11.242.31:443
192.210.222.88:443
Unpacked files
SH256 hash:
1907d75f0990ea1d63b3117f346303d6713856fd5d250d2c932eed61e7e7a5dc
MD5 hash:
cf693d0f865c21baef1e12311e837e49
SHA1 hash:
b57510297a24c1c4e822e80d12a68f62c847d8e5
Link:
https://www.unpac.me/results/ba9ceb43-57cf-424e-93c2-9988ce5162b8/
SH256 hash:
3f8cb5e7d3fe358593d5c4f65ffc4e0af02bbf52cd4a7a83bfb720cbc866781f
MD5 hash:
35c3b07f01065e5ffb28802ec36470ff
SHA1 hash:
1807839ab83e81857500306533ff2c2c26c2f5bb
Link:
https://www.unpac.me/results/ba9ceb43-57cf-424e-93c2-9988ce5162b8/
SH256 hash:
be62bd296d68f4ffcdb03f51859d8a10cab786435812842679e594564ebafe5f
MD5 hash:
7927f5cb81ae68172215ab93c41f2b99
SHA1 hash:
e992cdf00c2eb2b44d001a2c7511b7768bc35554
Link:
https://www.unpac.me/results/ba9ceb43-57cf-424e-93c2-9988ce5162b8/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/be62bd296d68f4ffcdb03f51859d8a10cab786435812842679e594564ebafe5f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DanaBot

Executable exe be62bd296d68f4ffcdb03f51859d8a10cab786435812842679e594564ebafe5f

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1640605/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/193890/

Comments