MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 ee5d22a6100afb0935a51cc27ff16e833c796abce26d9ce254d66f30ab28c150. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
DanaBot
Vendor detections: 10
| SHA256 hash: | ee5d22a6100afb0935a51cc27ff16e833c796abce26d9ce254d66f30ab28c150 |
|---|---|
| SHA3-384 hash: | 0f8b37737f8a5ee128ce7c1b1ae805a5eb9833ac08f47565f2ce92f3ee872f4b923bd04470b996f20b0a694b738d1f0b |
| SHA1 hash: | 5e6205f57a65fed48134a9fb1de4277e63d4bcf3 |
| MD5 hash: | 90a89fc585f1c79b2629c9dd8520ddb9 |
| humanhash: | three-crazy-illinois-south |
| File name: | 90a89fc585f1c79b2629c9dd8520ddb9 |
| Download: | download sample |
| Signature | DanaBot |
| File size: | 1'121'792 bytes |
| First seen: | 2021-08-26 15:11:18 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 915c33ea178f4e014c52a0e08d0a2d56 (11 x RaccoonStealer, 1 x DanaBot, 1 x RedLineStealer) |
| ssdeep | 24576:ZhzaKR5eJP1CM3jE4Rq8umW7DCk9n/C9m+t9eAU6:6KyJNXE4Y86CkdCI+tgAU6 |
| Threatray | 260 similar samples on MalwareBazaar |
| TLSH | T1A135232476B1C4BBF8C112B5482ADA2469A338D35D50A2573F804A9E3D723C855FDEEB |
| dhash icon | 4839b2b0e8c38890 (105 x RaccoonStealer, 38 x Smoke Loader, 33 x RedLineStealer) |
| Reporter |  zbetcheckin |
| Tags: | 32 DanaBot exe |
Intelligence
File Origin
# of uploads :
1
# of downloads :
1'218
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
90a89fc585f1c79b2629c9dd8520ddb9
Verdict:
Malicious activity
Analysis date:
2021-08-26 15:12:10 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Detection(s):
Result
Verdict:
Suspicious
Maliciousness:
Behaviour
Sending a custom TCP request
Creating a file
Enabling the 'hidden' option for recently created files
Sending a UDP request
Launching a process
Creating a process with a hidden window
Malware family:
Malicious Packer
Verdict:
Malicious
Result
Threat name:
DanaBot
Detection:
malicious
Classification:
bank.troj.adwa.spyw.evad
Score:
100 / 100
Signature
Adds a directory exclusion to Windows Defender
Bypasses PowerShell execution policy
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Enables a proxy for the internet explorer
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Sets a proxy for the internet explorer
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious Script Execution From Temp Folder
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal browser information (history, passwords, etc)
Yara detected DanaBot stealer dll
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Zenpak
Status:
Malicious
First seen:
2021-08-26 15:12:12 UTC
AV detection:
19 of 28 (67.86%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Similar samples:
+ 250 additional samples on MalwareBazaar
Result
Malware family:
danabot
Score:
10/10
Tags:
family:danabot banker discovery trojan
Behaviour
Checks processor information in registry
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Checks installed software on the system
Loads dropped DLL
Blocklisted process makes network request
Danabot
Danabot Loader Component
Unpacked files
SH256 hash:
bf4e92de21142b4c286f271b98107b4e45694fb471b06bc5e2c6238f7a1d6770
MD5 hash:
1dd049c42bad583f2e2476b02adb0489
SHA1 hash:
d592d8efcebe762e558a7969c1733f46db3d5c3b
SH256 hash:
6254b966cc6cbfc97a2f67e3047fc6500b400c212619bbf9adf614899f99bfd7
MD5 hash:
9ef18f9abf171179834dab9a37118045
SHA1 hash:
e99b33a0546517d65ddaa4748b8140e253c12810
SH256 hash:
ee5d22a6100afb0935a51cc27ff16e833c796abce26d9ce254d66f30ab28c150
MD5 hash:
90a89fc585f1c79b2629c9dd8520ddb9
SHA1 hash:
5e6205f57a65fed48134a9fb1de4277e63d4bcf3
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.url : hxxp://192.210.222.84/tepserv.exe