MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c025fab76e053df6abc1c6a5186920f5c34e2cd7d3a650998983dac479c8f4d8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DanaBot


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c025fab76e053df6abc1c6a5186920f5c34e2cd7d3a650998983dac479c8f4d8
SHA3-384 hash: a74df31f2a201d28d9e87df9b81e23630274f22fb180907766cdbc23fd7d93547f29fd153b80364ce12925d7fbfa3bec
SHA1 hash: 972420eff0a215549139fb1c6359bbddf9a09db5
MD5 hash: 71b7f48af385bb4ae1221c17197ddd1a
humanhash: arizona-pasta-skylark-michigan
File name:71b7f48af385bb4ae1221c17197ddd1a.exe
Download: download sample
Signature DanaBot
Create hunting rule
File size:1'169'408 bytes
First seen:2022-03-05 18:19:57 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash c1925c046b559a9fd93a9b8151eefcc1 (1 x DanaBot)
ssdeep 24576:q1NVTTCvhbhZEh6nboNNOoJisMWbnkVQB4ZOoHiu2:q165bhq6nMNNO2fvzkV7p
Threatray 9'836 similar samples on MalwareBazaar
TLSH T12C450210BAA0C039D4B311F87976C3ADB53E7EB05B6411CB53D66ADE66396E1EC3120B
File icon (PE):PE icon
dhash icon 2dac1378399b9b91 (35 x Smoke Loader, 34 x RedLineStealer, 18 x Amadey)
Reporter abuse_ch
Tags:DanaBot exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
539
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/247558/
Detection(s):
Win.Dropper.Generickdz-9939781-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Creating a window
Launching a process
Sending an HTTP GET request
Sending a custom TCP request
Creating a file in the %temp% directory
Сreating synchronization primitives
Unauthorized injection to a system process
Sending a TCP request to an infection source
Result
Malware family:
n/a
Score:
  9/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/8302/overview
Behaviour
MalwareBazaar
MeasuringTime
CPUID_Instruction
SystemUptime
EvasionQueryPerformanceCounter
EvasionGetTickCount
CheckCmdLine
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
DanaBot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/9fdda12a-a217-4d82-be0a-870fcef670f6
Result
Threat name:
DanaBot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/951248
Signature
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found potential dummy code loops (likely to delay analysis)
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Yara detected DanaBot stealer dll
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c025fab76e053df6abc1c6a5186920f5c34e2cd7d3a650998983dac479c8f4d8/
Threat name:
Win32.Trojan.DanaBot
Create hunting rule
Status:
Malicious
First seen:
2022-03-05 13:50:59 UTC
File Type:
PE (Exe)
Extracted files:
40
AV detection:
21 of 27 (77.78%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
0b4784972468b114e8fb957769af4aa76d1f050ef4913296f1a3c412afa5b49e
DanaBot
3b9cd0cbd0216c7880e6edbf90c8c98d0800f7a562c3a845559b3375dfa09f8f
DanaBot
532e3e9ec546f0030d3fef0bddc224f868c55bb00d1914cdb7157a3e74f5bd28
DanaBot
576ddf77b8b7a0685f8619125f16bbaebd35b38caf08c5ef6ea19be5a080125b
DanaBot
69f4f29d3eb2f05d7b7f4f736375765b7ed97d0948460adb95ad134b1f54a880
DanaBot
90ac445f282c66552b08d176d123635537170009fa83988ce5011aef18ba5fb9
DanaBot
97a1dadc6e1ccaa807240649c63f175169b0badaf65be530e98ad7790d69fc1e
DanaBot
9ff6891ef4465e0a3ee08520c57c133ea47ea72c408c165d2aab578b007fadf9
DanaBot
a0bc490c4a5263a90e83476958a538d960a94437432c4561008a6c9bb4af2b17
DanaBot
d5faba20007266314cf176b9e49ccbc35c3fd2b0982fcd73f7b5794539b42e89
DanaBot
+ 9'826 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
suricata
Link:
https://tria.ge/reports/220305-wyrp5aaeep/
Behaviour
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Checks processor information in registry
Enumerates physical storage devices
Program crash
Suspicious use of SetThreadContext
Blocklisted process makes network request
suricata: ET MALWARE Danabot Key Exchange Request
Unpacked files
SH256 hash:
979904f12c876ae6fa02821dffb392671600e85c44b54d291eba8af59e629ca1
MD5 hash:
8c60869f57f674d93b55731df4bc8ab9
SHA1 hash:
0fa90236c276faf2697f3c6b45cba1b6fb9418d8
Link:
https://www.unpac.me/results/ed033963-e367-4dbf-b117-037cc28c5d2c/
SH256 hash:
c025fab76e053df6abc1c6a5186920f5c34e2cd7d3a650998983dac479c8f4d8
MD5 hash:
71b7f48af385bb4ae1221c17197ddd1a
SHA1 hash:
972420eff0a215549139fb1c6359bbddf9a09db5
Link:
https://www.unpac.me/results/ed033963-e367-4dbf-b117-037cc28c5d2c/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c025fab76e053df6abc1c6a5186920f5c34e2cd7d3a650998983dac479c8f4d8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DanaBot

Executable exe c025fab76e053df6abc1c6a5186920f5c34e2cd7d3a650998983dac479c8f4d8

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/247558/
  
URLhaus
https://urlhaus.abuse.ch/url/2076755/
  
Delivery method
Distributed via web download

Comments