MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c61f097d08159136952af0fbed630194267a836b4df1450451a68cb8bfed12af. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DanaBot


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c61f097d08159136952af0fbed630194267a836b4df1450451a68cb8bfed12af
SHA3-384 hash: d32e2495f868d7a09c38465c80016ced1c4c559f3197530910249d0871ee02bd877a3d21757d149833297e5db69031bc
SHA1 hash: e07703685c4157a0ae210cea48b7242b63df3540
MD5 hash: 9fde37f16db114c6ec8c92a5fad17066
humanhash: blossom-pip-floor-connecticut
File name:9fde37f16db114c6ec8c92a5fad17066.exe
Download: download sample
Signature DanaBot
Create hunting rule
File size:1'074'688 bytes
First seen:2021-08-29 15:13:25 UTC
Last seen:2021-08-29 16:00:17 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash aa21a6d00a5d2896042e00aa2e960393 (11 x RaccoonStealer, 1 x Tofsee, 1 x DanaBot)
ssdeep 24576:5A9kXvcBpoyEqzGFgZmmH9oPzpt9z2oX0TXgktRD+kfuLzfQ+:v0BCyEqGFgNdoPzpt9zV0Hu/
Threatray 4'582 similar samples on MalwareBazaar
TLSH T14535232E3270E87FD1CA24B4596AA251363F2E23AE31D54F1F25527D7C6329188BE353
dhash icon 4839b2b0e8c38890 (105 x RaccoonStealer, 38 x Smoke Loader, 33 x RedLineStealer)
Reporter abuse_ch
Tags:DanaBot exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
1'072
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
https://www.google.com
Verdict:
Malicious activity
Analysis date:
2021-08-29 10:53:47 UTC
Tags:
trojan loader rat redline stealer vidar evasion opendir
Link:
https://app.any.run/tasks/10004576-5bda-4a32-85f8-9becfdde9a94

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/183276/
Detection(s):
SecuriteInfo.com.Variant.Fragtor.12980.18470.28167.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Creating a file
Enabling the 'hidden' option for recently created files
Sending a UDP request
Launching a process
Creating a process with a hidden window
Malware family:
DarkComet
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/38d9f0ce-0560-4073-a6fb-6e7b986ef9d3
Result
Threat name:
DanaBot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/841080
Signature
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Yara detected DanaBot stealer dll
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c61f097d08159136952af0fbed630194267a836b4df1450451a68cb8bfed12af/
Threat name:
Win32.Trojan.Zenpak
Create hunting rule
Status:
Malicious
First seen:
2021-08-29 13:35:43 UTC
AV detection:
19 of 46 (41.30%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=yypqs7iicwitnfjk6d562yybsqthva3ljxyukbcru2glrp7nckxq._file
Verdict:
unknown
Similar samples:
173240b443fdb5cc7ed97cf6eedeb0d823924df3dab6d468c9da2898443f3ac6
DanaBot
1bceb4e84115eabb8bf3df704b5cc014834ca08b126451ae95d60a968e66d666
DanaBot
2793bbaba9d12a4a740b6c957143367ce1fb13bb98ecb122e2cb41728bed525e
DanaBot
2fbf6c5454bb88073ecbc13b293375ec58a9f8636c188881ffd7a3573f3c1cac
DanaBot
596e82d24c64a373095159ee769df582d6f34fde24eb537aca442d8f01c491db
DanaBot
69fac4fe77b6da550498724f01e6db66d5c18a19c185d824bf62afdaccb0a7d6
DanaBot
786b9cb2fa5e78e4bc0d9e67e6f90c0229b150bacfd3e75cf46a9c3a67d57a67
DanaBot
8f71fca5621ccb7ba3558cfebc17014d27923d1c73ad97ececb577fd5b937047
DanaBot
8fa3eaa46c7d8d1f44a2eeca895f802f2aa7a2251bab347ccb765c72d63ccb58
DanaBot
dab48eb20191f37e19aed12dc58640ab40957cec26dc3fa63a88f70decbd875c
DanaBot
+ 4'572 additional samples on MalwareBazaar
Result
Malware family:
danabot
Create hunting rule
Score:
  10/10
Tags:
family:danabot banker trojan
Link:
https://tria.ge/reports/210829-hmpwgcbdae/
Behaviour
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Loads dropped DLL
Blocklisted process makes network request
Danabot
Danabot Loader Component
Malware Config
C2 Extraction:
23.229.29.48:443
5.9.224.204:443
192.210.222.81:443
Unpacked files
SH256 hash:
cdfcd326ea92fa6361bed00730a1e225c6c7991d86ed6778712fdde289b53be0
MD5 hash:
bfc3496e80383ef2d552190a69b853a9
SHA1 hash:
67a79a001b3e9477ead3cb0daecadf47d115d5ef
Link:
https://www.unpac.me/results/7e40e7c9-00a8-4df8-a164-247f59f4ee3c/
SH256 hash:
0e6ed8f2ee03803ab315430a37ebff38cee9dadff706f2866da73d0e1217c196
MD5 hash:
460acffa22e4bdec3eaa766c6460f626
SHA1 hash:
6830543f97fd2d47525fd6cb233d07cfa7a37c1a
Link:
https://www.unpac.me/results/7e40e7c9-00a8-4df8-a164-247f59f4ee3c/
SH256 hash:
c61f097d08159136952af0fbed630194267a836b4df1450451a68cb8bfed12af
MD5 hash:
9fde37f16db114c6ec8c92a5fad17066
SHA1 hash:
e07703685c4157a0ae210cea48b7242b63df3540
Link:
https://www.unpac.me/results/7e40e7c9-00a8-4df8-a164-247f59f4ee3c/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c61f097d08159136952af0fbed630194267a836b4df1450451a68cb8bfed12af

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DanaBot

Executable exe c61f097d08159136952af0fbed630194267a836b4df1450451a68cb8bfed12af

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1552888/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/183276/

Comments