🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d33ca5446399cc610653ec6ef86880c9494047aa6f916fddd93290c96bb08cbd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DanaBot


Vendor detections: 10


Intelligence 10 IOCs 1 YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d33ca5446399cc610653ec6ef86880c9494047aa6f916fddd93290c96bb08cbd
SHA3-384 hash: 07755411ff562d5894eb9de8062dc94f88f2749f51186f0d71e7ca338b80b1da5ee4546a8588640fe61d28015ed2dcd5
SHA1 hash: 6f91ed1b26e9a4b59efa5354cf4f1fe92a36a567
MD5 hash: 8416981f424fd3a6e60e90cd624499d7
humanhash: happy-autumn-oscar-hamper
File name:D33CA5446399CC610653EC6EF86880C9494047AA6F916.dll
Download: download sample
Signature DanaBot
Create hunting rule
File size:3'927'552 bytes
First seen:2022-03-04 11:00:57 UTC
Last seen:2022-03-04 12:54:18 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash c25c9ba614845e77a110de46f8dba5d9 (5 x DanaBot)
ssdeep 98304:Cf2F5luSGx6C1pIeudcGkfKpvylspMBzx0e09f17Q/YZHe0We:Q2flzGx6C1pIV8HEMBi7gYZq
TLSH T129063311BAD185BBD4E802F818779C15ADBFDE012B76086AB8D40A1FDCA4BC076167DF
Reporter abuse_ch
Tags:DanaBot dll


Avatar
abuse_ch
DanaBot C2:
23.106.123.249:443

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
23.106.123.249:443 https://threatfox.abuse.ch/ioc/392469/

Intelligence

File Origin
# of uploads :
2
# of downloads :
427
Origin country :
n/a
Vendor Threat Intelligence
Detection:
DanaBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/247327/
Detection(s):
SecuriteInfo.com.Trojan.Siggen11.57174.15733.31318.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Launching a process
Searching for synchronization primitives
Creating a window
Changing a file
Creating a file in the %temp% directory
Sending a custom TCP request
Modifying an executable file
Infecting executable files
Malware family:
DanaBot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/80d551bb-e2e0-4b8a-9508-e814b701afc3
Result
Threat name:
DanaBot
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/950697
Signature
Antivirus / Scanner detection for submitted sample
C2 URLs / IPs found in malware configuration
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: Suspicious Call by Ordinal
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal browser information (history, passwords, etc)
Yara detected DanaBot stealer dll
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 583178 Sample: D33CA5446399CC610653EC6EF86... Startdate: 04/03/2022 Architecture: WINDOWS Score: 100 37 Found malware configuration 2->37 39 Malicious sample detected (through community Yara rule) 2->39 41 Antivirus / Scanner detection for submitted sample 2->41 43 5 other signatures 2->43 8 loaddll32.exe 1 2->8         started        process3 process4 10 rundll32.exe 8->10         started        12 cmd.exe 1 8->12         started        14 rundll32.exe 8->14         started        16 2 other processes 8->16 process5 18 rundll32.exe 1 10->18         started        22 rundll32.exe 12->22         started        24 rundll32.exe 14->24         started        dnsIp6 29 108.62.118.103, 443, 49772 LEASEWEB-USA-WDCUS United States 18->29 31 108.62.141.152, 443, 49775 LEASEWEB-USA-NYC-11US United States 18->31 33 2 other IPs or domains 18->33 45 System process connects to network (likely due to code injection or exploit) 18->45 47 Tries to harvest and steal browser information (history, passwords, etc) 18->47 26 rundll32.exe 22->26         started        signatures7 process8 dnsIp9 35 127.0.0.1 unknown unknown 26->35
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d33ca5446399cc610653ec6ef86880c9494047aa6f916fddd93290c96bb08cbd/
Threat name:
Win32.Trojan.DanaBot
Create hunting rule
Status:
Malicious
First seen:
2021-01-02 09:49:57 UTC
File Type:
PE (Dll)
AV detection:
34 of 42 (80.95%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2m6kkrddthggcbst5rxpq2eazfeuar5kn6iw7xozgkims25qrs6q._file
Verdict:
malicious
Result
Malware family:
danabot
Create hunting rule
Score:
  10/10
Tags:
family:danabot botnet:3 banker discovery spyware stealer trojan
Link:
https://tria.ge/reports/220304-m4jr2aede8/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Checks installed software on the system
Drops desktop.ini file(s)
Reads user/profile data of web browsers
Blocklisted process makes network request
Danabot
Malware Config
C2 Extraction:
108.62.118.103:443
23.226.132.92:443
23.106.123.249:443
108.62.141.152:443
Unpacked files
SH256 hash:
243f5832f05d856b586d7b19c5c1b35535f229a9cae4021d6d8754e4245c561b
MD5 hash:
f67127e9b550ed72cc23be806599e320
SHA1 hash:
f293a32a32a61ef5f92afcbc03dcd7c8334258d1
Link:
https://www.unpac.me/results/3500e9fa-f11e-4310-af7a-0eeb92945a4f/
SH256 hash:
d33ca5446399cc610653ec6ef86880c9494047aa6f916fddd93290c96bb08cbd
MD5 hash:
8416981f424fd3a6e60e90cd624499d7
SHA1 hash:
6f91ed1b26e9a4b59efa5354cf4f1fe92a36a567
Link:
https://www.unpac.me/results/3500e9fa-f11e-4310-af7a-0eeb92945a4f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d33ca5446399cc610653ec6ef86880c9494047aa6f916fddd93290c96bb08cbd

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:hunt_skyproj_backdoor
Create hunting rule
Author:SBousseaden
Reference:https://unit42.paloaltonetworks.com/unit42-prince-persia-ride-lightning-infy-returns-foudre/
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many file transfer clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
Author:ditekSHen
Description:Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Rule name:INDICATOR_SUSPICIOUS_PWSH_PasswordCredential_RetrievePassword
Create hunting rule
Author:ditekSHen
Description:Detects PowerShell content designed to retrieve passwords from host
Rule name:MALWARE_Win_DanaBot
Create hunting rule
Author:ditekSHen
Description:Detects DanaBot variants

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/247327/

Comments