MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dd48b654a29ffa4f76904123aeb256369e77d202f7d21773999c2258078ae947. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

DanaBot

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments

SHA256 hash:	dd48b654a29ffa4f76904123aeb256369e77d202f7d21773999c2258078ae947
SHA3-384 hash:	5ed5181705723b1680efbeea283f7544a356075c1de27f6e0f05752d7febcdc30b8d60de405b4c5ed9492750f00f6397
SHA1 hash:	37043155b49ab15e894bbd280c319a6e09c4d500
MD5 hash:	400a26226efb786460f2ed6c23b38071
humanhash:	zulu-wisconsin-leopard-helium
File name:	file
Download:	download sample
Signature	DanaBot Create hunting rule
File size:	1'156'096 bytes
First seen:	2022-11-19 17:43:58 UTC
Last seen:	2022-11-19 19:34:15 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	3a28fc6cbd66b78dccc28e56534d2c76 (7 x Amadey, 4 x Smoke Loader, 1 x RedLineStealer)
ssdeep	24576:ih4KxyHBE6Kbk5CvlZyemuXAhmbHBoR7MQUxqIW:mEhd0lWIBaTU49
Threatray	11 similar samples on MalwareBazaar
TLSH	T124351200FEE18079E0BDC6307655C3E99678ACA16665D72763782B4E3DF23809F62376
TrID	48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 16.4% (.EXE) Win64 Executable (generic) (10523/12/4) 10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	f8f894b4b494d9c1 (2 x Tofsee, 1 x GrandaMisha, 1 x Amadey)
Reporter	jstrosch
Tags:	DanaBot exe

Intelligence

File Origin

# of uploads :

# of downloads :

197

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

file

Verdict:

Malicious activity

Analysis date:

2022-11-19 17:45:08 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/d1cbd82e-e950-4c62-9529-c9e0cdf8cc1c

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/336170/

Detection(s):

SecuriteInfo.com.Win32.DropperX-gen.19221.24618.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Searching for the window

Creating a file in the %temp% directory

Launching a process

Creating a process with a hidden window

Creating a window

Searching for synchronization primitives

Launching the default Windows debugger (dwwin.exe)

Sending a custom TCP request

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware packed

Link:

https://www.filescan.io/uploads/637915e75f223762e6edd9c4/reports/3ae2365a-fd72-4d50-a0f5-c67d7e139a8b/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Malicious Packer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/a33db727-f81d-4b59-827e-e3809537e54e

Result

Threat name:

Unknown

Detection:

malicious

Classification:

evad

Score:

76 / 100

Link:

https://www.joesandbox.com/analysis/1117275

Signature

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/dd48b654a29ffa4f76904123aeb256369e77d202f7d21773999c2258078ae947/

Threat name:

Win32.Trojan.BotX

Status:

Malicious

First seen:

2022-11-19 17:44:17 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

14 of 26 (53.85%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3velmvfct75e65uqier25mswg2phpuqc67jbo44ztqrfqb4k5fdq._file

Verdict:

malicious

Result

Malware family:

n/a

Score:

8/10

Tags:

n/a

Link:

https://tria.ge/reports/221119-wa5l3sge8x/

Behaviour

Checks processor information in registry

Modifies registry class

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

Suspicious use of SetThreadContext

Loads dropped DLL

Blocklisted process makes network request

Verdict:

Informative

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/13de5e02-d34d-457c-b0fe-82fbe265d310

Unpacked files

SH256 hash:

4b4e02e0c56daa11038313a87dd27c84b7090865ccd3c339d2db455136dfd471

MD5 hash:

7df0f64c322547b9466a7d32fc763a0a

SHA1 hash:

b4cc853243c361695a851f81ff12bdbc14f0b1fb

Link:

https://www.unpac.me/results/115882c9-b67c-446d-b93c-a4651544f0e7/

SH256 hash:

a5fe9e1951ec9b31e5bb32c783e2199e6ea801c4156dd63fef7a0da055e83333

MD5 hash:

f732822a32763f20e59a8e5caaabc7d0

SHA1 hash:

d5fdb68002a677a05d395a551caa838b7ab09b7d

Link:

https://www.unpac.me/results/115882c9-b67c-446d-b93c-a4651544f0e7/

SH256 hash:

dd48b654a29ffa4f76904123aeb256369e77d202f7d21773999c2258078ae947

MD5 hash:

400a26226efb786460f2ed6c23b38071

SHA1 hash:

37043155b49ab15e894bbd280c319a6e09c4d500

Link:

https://www.unpac.me/results/115882c9-b67c-446d-b93c-a4651544f0e7/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.