MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e9f4121f88f1eed6713b012ff7151429bf4c3932b41f3699220ad56e656ef7e9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

DanaBot

Vendor detections: 12

Intelligence 12 IOCs 1 YARA File information Comments

SHA256 hash:	e9f4121f88f1eed6713b012ff7151429bf4c3932b41f3699220ad56e656ef7e9
SHA3-384 hash:	70a3fb5eb5f0b1ef675535f3ae01ca936698e9825b5f5cc01935d0469ce1ba7c7e6ffb517d556670788001bbf8752b9e
SHA1 hash:	051b4ff748c54e18109bed294f73f8c6e15eddad
MD5 hash:	0552fb4843b69dd36d6fdd8908255f35
humanhash:	fruit-robin-yankee-massachusetts
File name:	0552fb4843b69dd36d6fdd8908255f35.exe
Download:	download sample
Signature	DanaBot Create hunting rule
File size:	281'600 bytes
First seen:	2022-04-16 07:05:41 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	324598d8e157ef332c75a6946f19434c (5 x DanaBot, 1 x Smoke Loader)
ssdeep	3072:qtFmbDfo6OAMpKqsxEv7y2yjMIu+dlAz3AcitfCGE5AM/h3IsxkgaBChhRv41F:cFYDfoAMUqsx2y2yjeGmwcUfCGkigaQ
Threatray	14'219 similar samples on MalwareBazaar
TLSH	T1AB549D7176A0C432D0575E309839CFB05A6FBC615A74857AF3A42B5E3E3238359A632F
TrID	48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 16.4% (.EXE) Win64 Executable (generic) (10523/12/4) 10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	480c1c4c4f590b14 (113 x Smoke Loader, 92 x RedLineStealer, 83 x Amadey)
Reporter	abuse_ch
Tags:	DanaBot exe

abuse_ch

DanaBot C2:
23.254.129.180:443

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
23.254.129.180:443	https://threatfox.abuse.ch/ioc/520331/

Intelligence

File Origin

# of uploads :

# of downloads :

801

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

0552fb4843b69dd36d6fdd8908255f35.exe

Verdict:

No threats detected

Analysis date:

2022-04-16 07:08:24 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/aa61f802-c40a-4e97-bdc1-56a396e2605c

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/264093/

Detection(s):

Win.Dropper.Stop-9938042-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Sending a custom TCP request

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

DNS request

Sending an HTTP POST request

Enabling autorun by creating a file

Result

Malware family:

n/a

Score:

8/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/14021/overview

Behaviour

MalwareBazaar

MeasuringTime

SystemUptime

EvasionGetTickCount

EvasionQueryPerformanceCounter

CheckCmdLine

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

greyware

Link:

https://www.filescan.io/uploads/625a6adbffe27d5119e3fc63/reports/9e529804-e31d-4abc-8b88-72e517b6aa8b/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Loki

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/71fe2b2e-634d-4ae3-99fd-6b4e5293581b

Result

Threat name:

SmokeLoader

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/977645

Signature

Antivirus detection for URL or domain

Benign windows process drops PE files

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Detected unpacking (changes PE section rights)

Found malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

System process connects to network (likely due to code injection or exploit)

Yara detected SmokeLoader

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e9f4121f88f1eed6713b012ff7151429bf4c3932b41f3699220ad56e656ef7e9/

Threat name:

Win32.Trojan.Strab

Status:

Malicious

First seen:

2022-04-16 07:06:08 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

17 of 26 (65.38%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=5h2beh4i6hxnm4j3aex7ofiufg7uyojswqptngjcblkw4zlo67uq._file

Verdict:

malicious

Result

Malware family:

smokeloader

Score:

10/10

Tags:

family:smokeloader backdoor trojan

Link:

https://tria.ge/reports/220416-hw3gysgbd7/

Behaviour

Checks SCSI registry key(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Program crash

Blocklisted process makes network request

Downloads MZ/PE file

Executes dropped EXE

SmokeLoader

Malware Config

C2 Extraction:

http://coralee.at/upload/
http://ducvietcao.com/upload/
http://biz-acc.ru/upload/
http://toimap.com/upload/
http://bbb7d.com/upload/
http://piratia-life.ru/upload/
http://curvreport.com/upload/
http://viagratos.com/upload/
http://mordo.ru/upload/
http://pkodev.net/upload/