MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c1a6950add3c21f8a22d63247c7aa67e7ef66aa4fcc207e582b48e755521be23. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DanaBot


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c1a6950add3c21f8a22d63247c7aa67e7ef66aa4fcc207e582b48e755521be23
SHA3-384 hash: 32d0a501f718b9a95f5c6fea51dba27d0ed2e1870aaf1207716af10bc06e2360ba6db1213362be61df88a93a98610e3c
SHA1 hash: d25257275756121a6b5ef451f74a7720ff51aa66
MD5 hash: 435129050751ef6593bd738a96facd17
humanhash: saturn-black-nevada-ceiling
File name:435129050751ef6593bd738a96facd17.exe
Download: download sample
Signature DanaBot
Create hunting rule
File size:1'185'792 bytes
First seen:2022-12-10 08:00:07 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash d3b4761b2a14aecd203c0715a7523520 (3 x RedLineStealer, 2 x Smoke Loader, 2 x Amadey)
ssdeep 24576:QaFNYSHGJztCVW0UaP7DLITn+vUX13m0/X+xCyv/7q2cORzI1UkL5:QaKsqaP76nNXx/uwyv/m2lOL5
Threatray 31 similar samples on MalwareBazaar
TLSH T1F04512613291E471F50C45748522D7E0E97AF8315F20860B77EC6A1E6FF33818BAAE97
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 480c1c4c4e590904 (18 x Smoke Loader, 4 x Amadey, 2 x RedLineStealer)
Reporter abuse_ch
Tags:DanaBot exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
185
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/344884/
Detection(s):
Win.Packer.pkr_ce1a-9980177-0
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Creating a window
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
DNS request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
azorult greyware lockbit packed
Link:
https://www.filescan.io/uploads/63943cc19a505ad9423eaa48/reports/ac505b2f-43d8-4736-aedc-464b0b62a668/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Loki
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/9f68d22a-f1cd-4dc1-a4ed-9b6d84ac30d2
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/1131823
Signature
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c1a6950add3c21f8a22d63247c7aa67e7ef66aa4fcc207e582b48e755521be23/
Threat name:
Win32.Ransomware.StopCrypt
Create hunting rule
Status:
Malicious
First seen:
2022-12-10 08:01:10 UTC
File Type:
PE (Exe)
Extracted files:
61
AV detection:
23 of 39 (58.97%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ygtjkcw5hqq7rirnmmshy6vgpz7pm2ve7tbapzmcwshhkvjbxyrq._file
Verdict:
malicious
Similar samples:
02b20e4db8bf0d25be410c25b1d51a31eef5d6ff8e8231eb9b6f201ad95775c0
DanaBot
034a5406b76b4bd449648cd166a25e6d073b71a9a4ead464ef70bfcec5acfa7f
DanaBot
209623f82b569fb476fdef4b1b84b253fd7b224ec5161867e134783a1ae30740
DanaBot
2b610520f96a2e63100ec1433f822e7eeb2cf069b2006560ec42619c6dfe4d30
DanaBot
3e95cf2840767ca2dd125e4eea9e00f455fdbd1a981d883e0f177d9eb4115083
DanaBot
5ab27758ec65b98b31e5b337696cb09409a19e2563a4694c7da79cff7e894ded
DanaBot
5f68ee5d17015571bbd0707a228004e39d71d461ce0d783c7b90f48ede7a45f8
DanaBot
79f89252957a5c3a833aea9dcd27aab5b8a21e933c0234b7854c548fe6093e5e
DanaBot
a3dbe790fa3c5ba4de23b81f52d76a39284cfe75e2d1e467c1c13ef67f2b5fd2
DanaBot
c8c043112b7f6ca1275a197add49d5d6d544f4290bd7a8da3ff5b24a11bf28b9
DanaBot
+ 21 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/221210-jwkgtafb38/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
Loads dropped DLL
Blocklisted process makes network request
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/6969aa49-cfb7-4681-b35e-c16fc459c675
Unpacked files
SH256 hash:
338bf223538fda403d18e685bbdae7d9d1d88df9ec2cdcb7dac1c52a26ae52f7
MD5 hash:
28f7d884f4f18ce6596dc3c81805e7ff
SHA1 hash:
e3ee8e4fe55c3faa782e100418407d60e227fe3c
Link:
https://www.unpac.me/results/9d5a37ee-e276-4dbf-afbb-37047c287caf/
SH256 hash:
3c41bd882aeedd04466954ea6857b61459ae85bb92251b80c6c615c3601fb3a3
MD5 hash:
85a10b08013d67a615f4e6f8aff6687b
SHA1 hash:
123bb1cdacaf1de2ff8428240dd570ace0e4a789
Link:
https://www.unpac.me/results/9d5a37ee-e276-4dbf-afbb-37047c287caf/
SH256 hash:
c1a6950add3c21f8a22d63247c7aa67e7ef66aa4fcc207e582b48e755521be23
MD5 hash:
435129050751ef6593bd738a96facd17
SHA1 hash:
d25257275756121a6b5ef451f74a7720ff51aa66
Link:
https://www.unpac.me/results/9d5a37ee-e276-4dbf-afbb-37047c287caf/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c1a6950add3c21f8a22d63247c7aa67e7ef66aa4fcc207e582b48e755521be23

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DanaBot

Executable exe c1a6950add3c21f8a22d63247c7aa67e7ef66aa4fcc207e582b48e755521be23

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2423260/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/344884/

Comments