MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e47855a42c8afd728d7bce24143487d89d90d4ea4e7bc8e91141f096dfe714de. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DanaBot


Vendor detections: 11


Intelligence 11 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e47855a42c8afd728d7bce24143487d89d90d4ea4e7bc8e91141f096dfe714de
SHA3-384 hash: 87b8633495cacf0ac6d878258ecf274001cc355637d869de7d3ff8f2cbbbcb0b6b14e0b37edb1d6b039a857f63d76fbf
SHA1 hash: b2db14167809cd17a6efa25ab4830d9c2b330e78
MD5 hash: beb149b6b4f38998caba2b88d8a4efda
humanhash: fillet-india-coffee-shade
File name:beb149b6b4f38998caba2b88d8a4efda.exe
Download: download sample
Signature DanaBot
Create hunting rule
File size:1'131'520 bytes
First seen:2022-12-12 15:16:18 UTC
Last seen:2022-12-12 16:37:59 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 27fc514cfd775c984573e93b88b08234 (9 x Smoke Loader, 1 x RecordBreaker, 1 x DanaBot)
ssdeep 24576:weptO3lTpi3o5KhlVKSbduexUl3rwnUV6gpGWpOKijgRANsKw:w8tilTI3aGKSbkQi6OJijvN
Threatray 33 similar samples on MalwareBazaar
TLSH T1663512213A90E033C24189305D1AD6E5BAAEBCF29B51958326943EFEDE707D1573D387
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 9a9acefecee6eae6 (50 x Smoke Loader, 41 x Amadey, 12 x RedLineStealer)
Reporter abuse_ch
Tags:DanaBot exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
195
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
beb149b6b4f38998caba2b88d8a4efda.exe
Verdict:
Malicious activity
Analysis date:
2022-12-12 15:17:32 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/96795c2f-99de-4fa5-82c0-fef0e699ac0a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/345494/
Detection(s):
SecuriteInfo.com.Heur.Mint.Zard.53.26676.27979.UNOFFICIAL
Create hunting rule

Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Creating a window
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Sending a custom TCP request
Sending an HTTP GET request
Searching for the window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/639745f0a2c2485912c80752/reports/eebf5aab-b9a7-47bd-8590-7cb78cd63ef3/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f99eeb28-c062-4d35-adb1-1d8a2d35fd66
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/1132808
Signature
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e47855a42c8afd728d7bce24143487d89d90d4ea4e7bc8e91141f096dfe714de/
Threat name:
Win32.Trojan.MintZard
Create hunting rule
Status:
Malicious
First seen:
2022-12-12 15:17:08 UTC
File Type:
PE (Exe)
Extracted files:
60
AV detection:
21 of 25 (84.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4r4fljbmrl6xfdl3zysbineh3cozbvhkjz54r2irihyjnx7hctpa._file
Verdict:
malicious
Similar samples:
0aedafe02dfc6eb2c72ce586ba7fbd0ccfc8eaeb41c526d5f113b13868a3402f
DanaBot
0f61e4c12e7b1adaef470477741d36eb115d8ec9fb6ad827e6db4104b2d9ca85
DanaBot
1e178cb5d1ceea8f6a38b6ac8c8cf7f930419e89d9d2c161548643dcff600c96
DanaBot
209623f82b569fb476fdef4b1b84b253fd7b224ec5161867e134783a1ae30740
DanaBot
b945d3da38ae64be812672282c821e3aab404ae453e617ca6c2f335b94de0726
DanaBot
ba64ac453d154d8c046addc8e5068452ed2523daff2d5089b11fb57d5f8fa4f1
DanaBot
bcbf1a4e0e0c081d97edc36d5889a78278a4f5c51b48be0ba84aa368c35d71dd
DanaBot
c1a6950add3c21f8a22d63247c7aa67e7ef66aa4fcc207e582b48e755521be23
DanaBot
dd48b654a29ffa4f76904123aeb256369e77d202f7d21773999c2258078ae947
DanaBot
ef6ac2c16346e465017474b1d41940bd74b832256cf21430e73c2ed877b4e7e7
DanaBot
+ 23 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/221212-sn1y9sbf62/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
Loads dropped DLL
Blocklisted process makes network request
Verdict:
Informative
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/d41a49cb-9bf1-4092-b90b-8f4d6608ad05
Unpacked files
SH256 hash:
af0c6c249f99ff70ee840bae221dd9e7c7875649e9fbac9749f6006edbd1aa72
MD5 hash:
85420fc2c9252ce18d78ab3a53583619
SHA1 hash:
55919ee808fe031152df6297baa8ac4ad51ed6dd
Link:
https://www.unpac.me/results/cb818251-bb70-4847-abda-46a2c644da4a/
SH256 hash:
48a5fdca76a2db4cce395cf1e8d2f6eb767539e246d0ce39e234cd1e753e86c8
MD5 hash:
fdc474055989deda71ca22f155f9784e
SHA1 hash:
09dc6aa26d964466375959dd133c28607e06defd
Link:
https://www.unpac.me/results/cb818251-bb70-4847-abda-46a2c644da4a/
SH256 hash:
e47855a42c8afd728d7bce24143487d89d90d4ea4e7bc8e91141f096dfe714de
MD5 hash:
beb149b6b4f38998caba2b88d8a4efda
SHA1 hash:
b2db14167809cd17a6efa25ab4830d9c2b330e78
Link:
https://www.unpac.me/results/cb818251-bb70-4847-abda-46a2c644da4a/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e47855a42c8afd728d7bce24143487d89d90d4ea4e7bc8e91141f096dfe714de

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/345494/

Comments