MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cf57cc27a823806f6012096ebd1eca04ca4d6a837b664c829a9d037d821d7f86. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DanaBot


Vendor detections: 10


Intelligence 10 IOCs 1 YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cf57cc27a823806f6012096ebd1eca04ca4d6a837b664c829a9d037d821d7f86
SHA3-384 hash: d57beaf06be6af5c656a8d325821b84ba5c96e608d63ef4a50cd4c9aa60ed53203a429e48d68aef4ed75b24239389f02
SHA1 hash: 209138397d7637dc1fef8ce7634437507575134d
MD5 hash: fb0721a87fbdd82b9c019d59ce777117
humanhash: blossom-leopard-rugby-carbon
File name:cf57cc27a823806f6012096ebd1eca04ca4d6a837b664.exe
Download: download sample
Signature DanaBot
Create hunting rule
File size:2'254'848 bytes
First seen:2022-03-22 17:07:16 UTC
Last seen:2022-03-22 18:59:05 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash e36bf2cd7229c855562e0cd74016f1d8 (6 x DanaBot)
ssdeep 49152:/5G7QM+NX5mKjSKhENuXHjSJUv0dojum3TH:/5GsgtNejSJg0doj
TLSH T1A9A55D22A240B12BD07E0736652A994D803E3674DA259C7FF7D44D4CAEFDBD0962E31B
Reporter abuse_ch
Tags:DanaBot exe


Avatar
abuse_ch
DanaBot C2:
192.236.146.173:443

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
192.236.146.173:443 https://threatfox.abuse.ch/ioc/439503/

Intelligence

File Origin
# of uploads :
2
# of downloads :
546
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/254934/
Detection(s):
SecuriteInfo.com.Variant.Midie.108052.23659.4656.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Sending a custom TCP request
Sending an HTTP GET request
Creating a file in the %temp% directory
Сreating synchronization primitives
Searching for synchronization primitives
Adding a root certificate
Creating a process with a hidden window
Setting a new proxy server as a default one
Enabling the use of the proxy server
Sending a UDP request
Unauthorized injection to a system process
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/10542/overview
Behaviour
MalwareBazaar
CheckNumberOfProcessor
LanguageCheck
CheckCmdLine
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
advpack.dll anti-debug anti-vm aspnet_compiler.exe cmstp.exe comsvcs.dll csc.exe diantz.exe esentutl.exe evasive expand.exe fingerprint gpscript.exe greyware hacktool ieadvpack.dll msdt.exe pcalua.exe printbrm.exe psr.exe reg.exe regedit.exe regini.exe regsvcs.exe replace.exe rundll32.exe runonce.exe shdocvw.dll shell32.dll stealer vbc.exe wscript.exe xwizard.exe zipfldr.dll
Link:
https://www.filescan.io/uploads/623a024fdfdfa8501ccda869/reports/cd58ce1d-2a0e-45e0-9a18-7c8ac7cc242f/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/962286
Signature
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cf57cc27a823806f6012096ebd1eca04ca4d6a837b664c829a9d037d821d7f86/
Threat name:
Win32.Trojan.Midie
Create hunting rule
Status:
Malicious
First seen:
2022-03-22 17:08:15 UTC
File Type:
PE (Exe)
AV detection:
19 of 42 (45.24%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=z5l4yj5ieoag6yasbfxl2hwkatfe22udpntezau2tubx3aq5p6da._file
Verdict:
malicious
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/220322-vnj2vsgda8/
Behaviour
Checks processor information in registry
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of SetThreadContext
Blocklisted process makes network request
Unpacked files
SH256 hash:
cf57cc27a823806f6012096ebd1eca04ca4d6a837b664c829a9d037d821d7f86
MD5 hash:
fb0721a87fbdd82b9c019d59ce777117
SHA1 hash:
209138397d7637dc1fef8ce7634437507575134d
Link:
https://www.unpac.me/results/44339d4a-d0d1-4c8b-9fbb-bda3a747c59e/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cf57cc27a823806f6012096ebd1eca04ca4d6a837b664c829a9d037d821d7f86

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/254934/

Comments