MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c2213cc74b11ff7931d042044d696bc98f047883032280ac1a6d7d7ec80f9389. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DanaBot


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c2213cc74b11ff7931d042044d696bc98f047883032280ac1a6d7d7ec80f9389
SHA3-384 hash: 16307d002be68a37f99b0ec2e094cf1e4520c34bcb7a7f5d73a5df9efeb4981a2c0d74abc84978e774c05274860ef256
SHA1 hash: 8743131f8c417a9a33120b9640a9d7f49dbb2770
MD5 hash: aa097cd2ea67822b909850f8f6df13b2
humanhash: shade-carolina-louisiana-oven
File name:aa097cd2ea67822b909850f8f6df13b2.exe
Download: download sample
Signature DanaBot
Create hunting rule
File size:6'422'943 bytes
First seen:2021-10-27 11:39:28 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash be41bf7b8cc010b614bd36bbca606973 (195 x LummaStealer, 126 x DanaBot, 63 x Vidar)
ssdeep 196608:/Og/9KGqkJ8F1qpRd1IgnpkN+i1wUoiHWWjEY2U1:/OEiG8WpLzpf3Uo0p1
Threatray 6'867 similar samples on MalwareBazaar
TLSH T160563355BFCAEEE6E4A1A930165393054A7CB9192CB1D51E72C0FF0DB371800AD26B9F
File icon (PE):PE icon
dhash icon 004001d0cce5789b (2 x DanaBot)
Reporter abuse_ch
Tags:DanaBot exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
289
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/200482/
Detection(s):
Win.Packed.Filerepmalware-9864117-0
Create hunting rule

Win.Packed.Stop-9872858-0
Create hunting rule

Win.Packed.Doina-9886276-0
Create hunting rule

Win.Packed.Pwsx-9901330-0
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Creating a window
Creating a file in the Program Files subdirectories
Deleting a recently created file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
overlay packed razy swisyn virus wacatac
Link:
https://www.filescan.io/uploads/61793a969a5a1e91c5d710b4/reports/accd9fce-ef01-42d8-8d39-339e2b84ccb7/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/8b794be4-f8fa-4eae-9554-eab7774c191b
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/877683
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Hides threads from debuggers
Machine Learning detection for dropped file
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Query firmware table information (likely to detect VMs)
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: WScript or CScript Dropper
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 510114 Sample: eMxXqjzvae.exe Startdate: 27/10/2021 Architecture: WINDOWS Score: 100 58 Antivirus detection for dropped file 2->58 60 Antivirus / Scanner detection for submitted sample 2->60 62 Multi AV Scanner detection for dropped file 2->62 64 5 other signatures 2->64 7 eMxXqjzvae.exe 25 2->7         started        10 IntelRapid.exe 2->10         started        13 IntelRapid.exe 2->13         started        process3 file4 32 C:\Users\user\AppData\Local\...\imbibe.exe, PE32+ 7->32 dropped 34 C:\Users\user\AppData\Local\...\galeusvp.exe, PE32 7->34 dropped 36 C:\Users\user\AppData\Local\Temp\...\UAC.dll, PE32 7->36 dropped 38 3 other files (none is malicious) 7->38 dropped 15 galeusvp.exe 3 18 7->15         started        20 imbibe.exe 4 7->20         started        76 Query firmware table information (likely to detect VMs) 10->76 78 Hides threads from debuggers 10->78 80 Tries to detect sandboxes / dynamic malware analysis system (registry check) 10->80 signatures5 process6 dnsIp7 42 ip-api.com 208.95.112.1, 49745, 80 TUT-ASUS United States 15->42 28 C:\Users\user\AppData\...\piuohfmqbk.vbs, ASCII 15->28 dropped 46 Antivirus detection for dropped file 15->46 48 Multi AV Scanner detection for dropped file 15->48 50 Query firmware table information (likely to detect VMs) 15->50 56 3 other signatures 15->56 22 wscript.exe 12 15->22         started        44 192.168.2.1 unknown unknown 20->44 30 C:\Users\user\AppData\...\IntelRapid.exe, PE32+ 20->30 dropped 52 Hides threads from debuggers 20->52 54 Tries to detect sandboxes / dynamic malware analysis system (registry check) 20->54 26 IntelRapid.exe 20->26         started        file8 signatures9 process10 dnsIp11 40 iplogger.org 88.99.66.31, 443, 49746 HETZNER-ASDE Germany 22->40 66 System process connects to network (likely due to code injection or exploit) 22->66 68 May check the online IP address of the machine 22->68 70 Query firmware table information (likely to detect VMs) 26->70 72 Hides threads from debuggers 26->72 74 Tries to detect sandboxes / dynamic malware analysis system (registry check) 26->74 signatures12
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c2213cc74b11ff7931d042044d696bc98f047883032280ac1a6d7d7ec80f9389/
Threat name:
Win32.Trojan.SelfDel
Create hunting rule
Status:
Malicious
First seen:
2021-10-26 19:43:34 UTC
AV detection:
23 of 28 (82.14%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
1d853f68927005c2158b9e5730d78b0c13e7306339a2807cc24fdbf82e37b647
DanaBot
4ea07b9988b03173d35240bd56cfe6b16b6f5721c62d16129c9d974bbab92d04
DanaBot
4f27a3fe51d0494d18648a7279b2a368f86288148b7c1044d4d24ae7e4dfcca1
DanaBot
80bed6ab0b5b8714354e174beb3be2c10a749dd8133c2e74f3ebdb4936e6f411
DanaBot
9115f3f67746a37f1219c0235046f51efc3ea0e1cef12aee42807c1b8a7ed7cc
DanaBot
9c183327a52687e89969b39d6e099f239161ce9876af0f8da666eb5e55c238c3
DanaBot
ab2c8662c8101b040f3b5e41eb3639b1be3ce9da6ac155f7a4b0fbe63bb3fde3
DanaBot
b0884a21366325f9e9242b357e7f3d5acf63b7b38e02988e1c1f3454230b5877
DanaBot
d7fccfe57f600475492fa8d41dde2c2d0d74fdc8e4d7151cb280dfb030441872
DanaBot
e13fb6156b386d9cea3a46c3835a97636ad0eeddda3b354f86f19915721638fc
DanaBot
+ 6'857 additional samples on MalwareBazaar
Result
Malware family:
danabot
Create hunting rule
Score:
  10/10
Tags:
family:danabot botnet:4 banker collection discovery evasion spyware stealer themida trojan
Link:
https://tria.ge/reports/211027-nsw4naeeh9/
Behaviour
Checks processor information in registry
Modifies registry class
Modifies system certificate store
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Program crash
Drops file in Program Files directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses Microsoft Outlook accounts
Accesses Microsoft Outlook profiles
Checks installed software on the system
Checks whether UAC is enabled
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Checks BIOS information in registry
Drops startup file
Loads dropped DLL
Reads user/profile data of web browsers
Themida packer
Blocklisted process makes network request
Downloads MZ/PE file
Executes dropped EXE
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Danabot
Suspicious use of NtCreateProcessExOtherParentProcess
Malware Config
C2 Extraction:
192.119.110.73:443
192.236.147.159:443
192.210.222.88:443
Unpacked files
SH256 hash:
18e6efb3fb4ce9fe44bedd9dda579af76cc7e937fa4c463ca2c78a769f6e2e78
MD5 hash:
774db1de3eaa8fd13dd1265e511fe0ef
SHA1 hash:
60b4d8f5e7c66bab4a2150e3c08175bbd139290d
Link:
https://www.unpac.me/results/8293ba3f-cf93-4c97-87b4-23c03aeb7308/
SH256 hash:
c2213cc74b11ff7931d042044d696bc98f047883032280ac1a6d7d7ec80f9389
MD5 hash:
aa097cd2ea67822b909850f8f6df13b2
SHA1 hash:
8743131f8c417a9a33120b9640a9d7f49dbb2770
Link:
https://www.unpac.me/results/8293ba3f-cf93-4c97-87b4-23c03aeb7308/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c2213cc74b11ff7931d042044d696bc98f047883032280ac1a6d7d7ec80f9389

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DanaBot

Executable exe c2213cc74b11ff7931d042044d696bc98f047883032280ac1a6d7d7ec80f9389

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/200482/
  
URLhaus
https://urlhaus.abuse.ch/url/1715397/
  
Delivery method
Distributed via web download

Comments