MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f15537b765f14194f81e9c422e942e9e04cf49a776a7385ef2c855757a14ec43. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DanaBot


Vendor detections: 10


Intelligence 10 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f15537b765f14194f81e9c422e942e9e04cf49a776a7385ef2c855757a14ec43
SHA3-384 hash: 133aa0ae9fb81bcada941200f9ad598481ed88ba402952f80786e015ea8a39ca61999bcef579b417febc827a1023f57a
SHA1 hash: b6aa34827afb29bd366390f6277641238acc4fb1
MD5 hash: 5a5e5574dcd59ff6484c60bccca46360
humanhash: ink-delta-montana-tennessee
File name:file
Download: download sample
Signature DanaBot
Create hunting rule
File size:1'155'584 bytes
First seen:2022-11-23 02:06:11 UTC
Last seen:2022-11-23 03:30:40 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 7e22feed739071e8c50ce1f9fbef6d80 (5 x Amadey, 4 x Smoke Loader, 1 x DanaBot)
ssdeep 24576:gyVKkgpcWrcjN6wUaG69rD3SocWy405lw:BArpcOcMaGe3iNp5lw
Threatray 21 similar samples on MalwareBazaar
TLSH T13D3512D13651F8B1C6431E77C865CFA0D82FA821FA1598B7274C6A2F2D3D2C2567336A
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 480c1c5c4f590904 (8 x Smoke Loader, 6 x Amadey, 2 x Tofsee)
Reporter jstrosch
Tags:DanaBot exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
199
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2022-11-23 02:08:51 UTC
Tags:
stealer
Link:
https://app.any.run/tasks/0d5f266d-5738-4d0a-b801-30d960934dd4

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/337397/
Detection(s):
SecuriteInfo.com.Win32.DropperX-gen.29688.8052.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Creating a window
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Sending a custom TCP request
Sending an HTTP GET request
Searching for the window
Сreating synchronization primitives
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
azorult greyware lockbit packed
Link:
https://www.filescan.io/uploads/637d804724da1c12cfe179b9/reports/75a15d98-ddde-4cba-9933-b29281360946/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/8b722e14-7664-4628-be22-37dbc50a92f0
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/1119363
Signature
Contain functionality to detect virtual machines
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f15537b765f14194f81e9c422e942e9e04cf49a776a7385ef2c855757a14ec43/
Threat name:
Win32.Trojan.SmokeLoader
Create hunting rule
Status:
Malicious
First seen:
2022-11-23 03:59:05 UTC
AV detection:
20 of 26 (76.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6fktpn3f6fazj6a6trbc5fbotycm6snho2ttqxxszbkxk6qu5rbq._file
Verdict:
malicious
Similar samples:
02b20e4db8bf0d25be410c25b1d51a31eef5d6ff8e8231eb9b6f201ad95775c0
DanaBot
266a52a74ce9a008c8436ffd773bf138f19dea6846c221ca1e969abff38f3135
DanaBot
2b610520f96a2e63100ec1433f822e7eeb2cf069b2006560ec42619c6dfe4d30
DanaBot
3e95cf2840767ca2dd125e4eea9e00f455fdbd1a981d883e0f177d9eb4115083
DanaBot
49b689697a30e3dfee54b0ddc0ac9a4d6d3ef855b1fee7b6715ca36a7b4b8d3b
DanaBot
5ab27758ec65b98b31e5b337696cb09409a19e2563a4694c7da79cff7e894ded
DanaBot
5f68ee5d17015571bbd0707a228004e39d71d461ce0d783c7b90f48ede7a45f8
DanaBot
79f89252957a5c3a833aea9dcd27aab5b8a21e933c0234b7854c548fe6093e5e
DanaBot
a3dbe790fa3c5ba4de23b81f52d76a39284cfe75e2d1e467c1c13ef67f2b5fd2
DanaBot
c8c043112b7f6ca1275a197add49d5d6d544f4290bd7a8da3ff5b24a11bf28b9
DanaBot
+ 11 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
collection discovery persistence spyware stealer
Link:
https://tria.ge/reports/221123-cjzmmsgc76/
Behaviour
outlook_win_path
Checks processor information in registry
Modifies registry class
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
outlook_office_path
Enumerates physical storage devices
Program crash
Drops file in Program Files directory
Suspicious use of SetThreadContext
Accesses Microsoft Outlook accounts
Accesses Microsoft Outlook profiles
Checks installed software on the system
Loads dropped DLL
Reads user/profile data of web browsers
Blocklisted process makes network request
Sets DLL path for service in the registry
Sets service image path in registry
Unpacked files
SH256 hash:
87183a4392fadeafd4d461ca4df15445894b030a82464d9e0b1e10ee5b01fe31
MD5 hash:
ea15db70b17c7e49dda01522d51efa86
SHA1 hash:
edb8806fc4e5dc8bcbee4b9ea08e1b3fff0685be
Link:
https://www.unpac.me/results/2f180b87-7997-480d-8464-3d5b6edc3c46/
SH256 hash:
65c3cf4595a9481b3a95cf089126ddb1293c7e559dd6d65115ab30b7ea5677c6
MD5 hash:
53cf75fbd16de0429bc3ff403e8bd4fa
SHA1 hash:
64586d403da91a20b7dbe2c99069cd29ad8054c8
Link:
https://www.unpac.me/results/2f180b87-7997-480d-8464-3d5b6edc3c46/
SH256 hash:
f15537b765f14194f81e9c422e942e9e04cf49a776a7385ef2c855757a14ec43
MD5 hash:
5a5e5574dcd59ff6484c60bccca46360
SHA1 hash:
b6aa34827afb29bd366390f6277641238acc4fb1
Link:
https://www.unpac.me/results/2f180b87-7997-480d-8464-3d5b6edc3c46/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f15537b765f14194f81e9c422e942e9e04cf49a776a7385ef2c855757a14ec43

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DanaBot

Executable exe f15537b765f14194f81e9c422e942e9e04cf49a776a7385ef2c855757a14ec43

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2423260/
Cape
Cape
https://www.capesandbox.com/analysis/337397/

Comments