MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d9bf93c5d1a4329270cf4c4321b7cf76f874402521a8903b45925c13a1fae6a8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DanaBot


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d9bf93c5d1a4329270cf4c4321b7cf76f874402521a8903b45925c13a1fae6a8
SHA3-384 hash: 6a6abde514a4f67957c0e86c4ccb45bfacf20f84b0134eb53702b180e05d1e289b29dc039e079844451c70c82c85d54a
SHA1 hash: 2ff6b3f8a9d522eafca58d46793f5b994fa93b2c
MD5 hash: ac95319747dc9aca26193c72186b2e66
humanhash: uncle-november-snake-mississippi
File name:ac95319747dc9aca26193c72186b2e66.exe
Download: download sample
Signature DanaBot
Create hunting rule
File size:1'078'784 bytes
First seen:2021-09-28 06:20:55 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f98cc9327e2d65cc6189a693f26e1c1d (5 x ArkeiStealer, 4 x RaccoonStealer, 3 x RedLineStealer)
ssdeep 24576:o2M3pWIOqJmnRIfF8eHcPNbD8tAWPSsFxJxn4:oBFOxRSFV8PSKuSsLJx4
Threatray 5'679 similar samples on MalwareBazaar
TLSH T18F3533103C905936CF118AF78953C5F4D96CFDAA1783C86237E42ABB4D7A9A07EF9112
File icon (PE):PE icon
dhash icon 4839b234e8c38890 (121 x RaccoonStealer, 54 x RedLineStealer, 51 x ArkeiStealer)
Reporter abuse_ch
Tags:DanaBot exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
216
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
ac95319747dc9aca26193c72186b2e66.exe
Verdict:
Malicious activity
Analysis date:
2021-09-28 06:22:38 UTC
Tags:
trojan danabot
Link:
https://app.any.run/tasks/fbc0a22f-e089-4309-a00f-b124f942b187

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
DanaBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/192370/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.37671222.32460.16302.UNOFFICIAL
Create hunting rule

Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Creating a file
Enabling the 'hidden' option for recently created files
Launching a process
Creating a process with a hidden window
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/0ea99394-b0e1-40c7-9742-e73a8d954442
Result
Threat name:
DanaBot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/859654
Signature
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Yara detected DanaBot stealer dll
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d9bf93c5d1a4329270cf4c4321b7cf76f874402521a8903b45925c13a1fae6a8/
Threat name:
Win32.Trojan.Sabsik
Create hunting rule
Status:
Malicious
First seen:
2021-09-28 03:19:00 UTC
AV detection:
17 of 28 (60.71%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3g7zhroruqzje4gpjrbsdn6po34hiqbfegujao2fsjobhip242ua._file
Verdict:
malicious
Similar samples:
2793bbaba9d12a4a740b6c957143367ce1fb13bb98ecb122e2cb41728bed525e
DanaBot
2fbf6c5454bb88073ecbc13b293375ec58a9f8636c188881ffd7a3573f3c1cac
DanaBot
596e82d24c64a373095159ee769df582d6f34fde24eb537aca442d8f01c491db
DanaBot
69fac4fe77b6da550498724f01e6db66d5c18a19c185d824bf62afdaccb0a7d6
DanaBot
6b10c55482a12c0302f16cd63bd73cd71c105d5dc4bd5d6756cf7656c2c6af69
DanaBot
721bf1dd5787108ecf31dd3bbab5e355ca55bdc68eb2358ce891290a7ce2048c
DanaBot
786b9cb2fa5e78e4bc0d9e67e6f90c0229b150bacfd3e75cf46a9c3a67d57a67
DanaBot
8f71fca5621ccb7ba3558cfebc17014d27923d1c73ad97ececb577fd5b937047
DanaBot
8fa3eaa46c7d8d1f44a2eeca895f802f2aa7a2251bab347ccb765c72d63ccb58
DanaBot
dab48eb20191f37e19aed12dc58640ab40957cec26dc3fa63a88f70decbd875c
DanaBot
+ 5'669 additional samples on MalwareBazaar
Result
Malware family:
danabot
Create hunting rule
Score:
  10/10
Tags:
family:danabot banker trojan
Link:
https://tria.ge/reports/210928-g4b5asagg3/
Behaviour
Suspicious use of WriteProcessMemory
Loads dropped DLL
Blocklisted process makes network request
Danabot
Danabot Loader Component
Malware Config
C2 Extraction:
192.236.194.86:443
142.11.192.232:443
Unpacked files
SH256 hash:
42db50e0b14f972b192571941ca41479d10f529727309906087df8a1569e6209
MD5 hash:
8ead717105aeb78570d405c5c7730271
SHA1 hash:
cdd40ebc788d286be5a716292f80bd12ffcf9dc5
Link:
https://www.unpac.me/results/ddffee1c-928f-443b-afdf-ce9d5a5e65cb/
SH256 hash:
7bb0495d691234ec46ce581bad500cade57a0bba614d432efc2798098a9aff8c
MD5 hash:
834179b3e851cc08b970134a112ac44f
SHA1 hash:
bc73007c46ce503b88d952dffb7f2d6a23ae8693
Link:
https://www.unpac.me/results/ddffee1c-928f-443b-afdf-ce9d5a5e65cb/
SH256 hash:
d9bf93c5d1a4329270cf4c4321b7cf76f874402521a8903b45925c13a1fae6a8
MD5 hash:
ac95319747dc9aca26193c72186b2e66
SHA1 hash:
2ff6b3f8a9d522eafca58d46793f5b994fa93b2c
Link:
https://www.unpac.me/results/ddffee1c-928f-443b-afdf-ce9d5a5e65cb/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d9bf93c5d1a4329270cf4c4321b7cf76f874402521a8903b45925c13a1fae6a8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DanaBot

Executable exe d9bf93c5d1a4329270cf4c4321b7cf76f874402521a8903b45925c13a1fae6a8

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1640605/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/192370/

Comments