MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dc08a5398078015abae12b7fb3ae55120a0d5dee49478e0ed99e69d38c48e9b7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

DanaBot

Vendor detections: 11

Intelligence 11 IOCs YARA 1 File information Comments

SHA256 hash:	dc08a5398078015abae12b7fb3ae55120a0d5dee49478e0ed99e69d38c48e9b7
SHA3-384 hash:	997fec0c8c844039b65daf0b39898a552df8998bf9dbf8bf94061a70dd7b1963f8f0d4c6e91ee5e8013704db807fa7ca
SHA1 hash:	ac84c504373fbc5cce83ad4818843ecedb9f6492
MD5 hash:	480006d8b90940c820ebdc8419d9e6a7
humanhash:	venus-golf-edward-island
File name:	SecuriteInfo.com.W32.AIDetect.malware2.26000.9412
Download:	download sample
Signature	DanaBot Create hunting rule
File size:	1'998'336 bytes
First seen:	2022-08-21 00:29:48 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	46f2867867039712c905f40e7a54c720 (3 x DanaBot, 2 x RecordBreaker, 1 x Smoke Loader)
ssdeep	49152:trO33hka1INsWdFMx/2gIrHDLu46WeENWDHJlZn1:trO3x3SNsKFMx/ejLueJNQHJj1
TLSH	T17C952350BAA0D038F1B790F8B93ACAE8B52A7D91676440C762D733DDA6302E5ED34347
TrID	40.3% (.EXE) Win64 Executable (generic) (10523/12/4) 19.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 17.2% (.EXE) Win32 Executable (generic) (4505/5/1) 7.7% (.EXE) OS/2 Executable (generic) (2029/13) 7.6% (.EXE) Generic Win/DOS Executable (2002/3)
File icon (PE):
dhash icon	b2dacabecee6baa2 (33 x RedLineStealer, 30 x Smoke Loader, 28 x Stop)
Reporter	SecuriteInfoCom
Tags:	DanaBot exe

Intelligence

File Origin

# of uploads :

# of downloads :

569

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

danabot

ID:

File name:

SecuriteInfo.com.W32.AIDetect.malware2.26000.9412

Verdict:

Malicious activity

Analysis date:

2022-08-21 00:32:46 UTC

Tags:

danabot

Link:

https://app.any.run/tasks/78ed0b72-6c73-4f1f-ad5c-dc9ab4df9205

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/299983/

Detection(s):

SecuriteInfo.com.W32.AIDetect.malware2.26000.9412.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a file in the %temp% directory

Launching a process

Creating a process with a hidden window

Launching the default Windows debugger (dwwin.exe)

Creating a window

Sending a custom TCP request

Searching for the window

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

greyware packed smoke

Link:

https://www.filescan.io/uploads/63017cd305ef0c24e41b280f/reports/72b330d8-5b3f-4de5-ae39-eb4517608b18/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

DanaBot

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/0133c661-5a0d-4b11-aea2-391a1ae3176e

Result

Threat name:

DanaBot

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1054928

Signature

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Tries to detect virtualization through RDTSC time measurements

Yara detected DanaBot stealer dll

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/dc08a5398078015abae12b7fb3ae55120a0d5dee49478e0ed99e69d38c48e9b7/

Threat name:

Win32.Trojan.RedLine

Status:

Malicious

First seen:

2022-08-20 22:10:45 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

24 of 26 (92.31%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=3qekkomapaavvoxbfn73hlsvcifa2xpojfdy4dwztzu5hdci5g3q._file

Verdict:

malicious

Result

Malware family:

danabot

Score:

10/10

Tags:

family:danabot banker collection discovery spyware stealer trojan

Link:

https://tria.ge/reports/220821-atgtgadcb2/

Behaviour

Checks processor information in registry

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Enumerates physical storage devices

Program crash

Suspicious use of SetThreadContext

Accesses Microsoft Outlook accounts

Accesses Microsoft Outlook profiles

Checks installed software on the system

Drops desktop.ini file(s)

Loads dropped DLL

Reads user/profile data of web browsers

Blocklisted process makes network request

Danabot

Malware Config

C2 Extraction:

104.168.247.161:443
23.254.226.20:443
131.153.22.173:443
192.236.162.2:443

Unpacked files

SH256 hash:

997f37fd0e3d6be281b254de3562d9b2a84845e4c5d2188f7e1f4c1e000f0ad2

MD5 hash:

3ad12294c77c1e4be27a939c86028884

SHA1 hash:

ab517d47e543d9842f42defc3c102fc9d9d5f668

Link:

https://www.unpac.me/results/a6e88301-86ef-46ea-8d8a-cd6b0062dc1a/

SH256 hash:

ba16bc816d271504031f5f9d884eb69d0238dc27e706b167a93f9e2e778a2afe

MD5 hash:

6eda600653075df374e23012b582f0e0

SHA1 hash:

e566a450c7a34faf2e7f888d638a9f83eeb5c63a

Link:

https://www.unpac.me/results/a6e88301-86ef-46ea-8d8a-cd6b0062dc1a/

SH256 hash:

dc08a5398078015abae12b7fb3ae55120a0d5dee49478e0ed99e69d38c48e9b7

MD5 hash:

480006d8b90940c820ebdc8419d9e6a7

SHA1 hash:

ac84c504373fbc5cce83ad4818843ecedb9f6492

Link:

https://www.unpac.me/results/a6e88301-86ef-46ea-8d8a-cd6b0062dc1a/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/dc08a5398078015abae12b7fb3ae55120a0d5dee49478e0ed99e69d38c48e9b7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.