MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e444e98ee06dc0e26cae8aa57a0cddab7b050db22d3002bd2b0da47d4fd5d78c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DanaBot


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e444e98ee06dc0e26cae8aa57a0cddab7b050db22d3002bd2b0da47d4fd5d78c
SHA3-384 hash: 2c0e4fae53d0a50787b88820481abbd56964f003ef5c6acbc8760208fdcfe8d5f818649b504ff35cf3a39b3a1f853405
SHA1 hash: bab4cf9b752885788d4f07c42a5dcca42b1193b6
MD5 hash: aa9d791d36be565f6d537f34f0ed9f6e
humanhash: item-victor-india-emma
File name:SecuriteInfo.com.Variant.Danabot.2.3619.11339
Download: download sample
Signature DanaBot
Create hunting rule
File size:942'080 bytes
First seen:2020-06-25 12:39:24 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b61a69f2e7e278b2bb923bcdfa41e4f8 (8 x DanaBot)
ssdeep 24576:eLie8ojfcZZSYp9UhyCDLIh9Uf7/bvP9cbMf:eoZFjUhyCAfYCS
Threatray 43 similar samples on MalwareBazaar
TLSH 9E1512F2E340883ECD950A36D8D45E08A43EBBB1EB24486F16D54CF9CD16367A56836F
Reporter SecuriteInfoCom
Tags:DanaBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
1'023
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/14270/
Detection(s):
SecuriteInfo.com.Variant.Danabot.2.3619.11339.UNOFFICIAL
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file
Launching a process
Creating a process with a hidden window
Searching for the window
Sending a custom TCP request
Detection:
danabot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/e444e98ee06dc0e26cae8aa57a0cddab7b050db22d3002bd2b0da47d4fd5d78c/
Threat name:
Win32.Trojan.DanaBot
Create hunting rule
Status:
Malicious
First seen:
2020-06-18 20:36:57 UTC
AV detection:
26 of 29 (89.66%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4rcotdxanxaoe3forksxudg5vn5qkdnsfuyafpjlbwsh2t6v26ga._file
Verdict:
malicious
Similar samples:
301fb66cb50056dca7644f1b087a2bfbba0f9649a8e5571fe1845d704cd78913
DanaBot
465e874f504c413d6971a48c1ba559d83cc622bd1884b18d1cae1cca608f42ab
DanaBot
5bc7a56b2dcc47933032f0ebde41aae2f6792e90c8a012a90ffc4ad824ee0abd
DanaBot
873062579a8fcd15a618aa702b2972fa15da96abe8fc2d9de71172fceba31774
DanaBot
99b57af659b47128ffbae221dd8523c29e2ee7c21da77d5258b8b6c839c1d378
DanaBot
bb53f47b4c6693ad29934983c001471b82827f659a724c97e2b1d13fd158fd34
DanaBot
c93e7028a1fa69efc978b71587df57ad05d06b9e290c33329c5f3fa83e10e247
DanaBot
da14fc981ff7eaaa731ffddfbe830230387467a19b191c48491d2583ceab9666
DanaBot
e127b93395eb2d0cf5b3b1e43257b342fb51f7b68e55615aed0366c2d313b875
DanaBot
f7e6d70e5553fb8c221304bf51126f457d4825194c4ef4f98915b28eb9942326
DanaBot
+ 33 additional samples on MalwareBazaar
Result
Malware family:
danabot
Create hunting rule
Score:
  10/10
Tags:
botnet trojan banker family:danabot
Link:
https://tria.ge/reports/200625-qx6s244qjs/
Behaviour
Suspicious use of WriteProcessMemory
Loads dropped DLL
Blacklisted process makes network request
Danabot x86 payload
Danabot
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/14270/

Comments