MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f377512454adebec7f32f1a33bda63e3476595be7857fb73c0e242407f29f616. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Snojan


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f377512454adebec7f32f1a33bda63e3476595be7857fb73c0e242407f29f616
SHA3-384 hash: ed9aa78b4ec306cf2475129d8617dcdd53105aac90786e5795204187a7ebd6997ce160f7680088c4a2fc6aa0cf9d22de
SHA1 hash: 857f6df8a63ea4df0022463e8ad8d0e73dfbe409
MD5 hash: a83f8f6e2f733845af01838054187d30
humanhash: avocado-low-pennsylvania-music
File name:SecuriteInfo.com.BehavesLike.Win32.Generic.tc.20832
Download: download sample
Signature Snojan
Create hunting rule
File size:1'100'288 bytes
First seen:2020-05-25 16:46:50 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash df36d81e67985d54573f77cd75437a36 (1 x Snojan)
ssdeep 24576:BTFC7hJzayy+jQb1KwESFbb/zmSQ9x1WfAtp:BxYJ7kzLbb6SQ9x1WYtp
Threatray 40 similar samples on MalwareBazaar
TLSH 4335120263E05C77D5728B3905DACA59ABAFBCB28F3769962204321B0D702D2D73E717
Reporter SecuriteInfoCom
Tags:Snojan

Intelligence

File Origin
# of uploads :
1
# of downloads :
101
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BehavesLike.Win32.Generic.tc.20832.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-25 13:37:42 UTC
File Type:
PE (Exe)
Extracted files:
42
AV detection:
21 of 31 (67.74%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
310d801624fa3aec311040427326e4e7d500f6b2a0fbfde77e34df4617c155f1
Snojan
46c14ac886a864d3ff77606286c4ce983a060d57bcd07881ab299b1848918af5
Snojan
62e5d2d34e0a074f96f9c3dbb9b27bab862a1d23e2a0062ca6d9889d6fe0b30d
Snojan
8c98355387cdad4550e82d642575634034955262583962b63617d8e2d79956bd
Snojan
af0b53ecd547b0a629164b818d8562a5b6c3a3c15d89a764fcdc87cf0f6d4489
Snojan
bb53f47b4c6693ad29934983c001471b82827f659a724c97e2b1d13fd158fd34
Snojan
c93e7028a1fa69efc978b71587df57ad05d06b9e290c33329c5f3fa83e10e247
Snojan
e127b93395eb2d0cf5b3b1e43257b342fb51f7b68e55615aed0366c2d313b875
Snojan
e444e98ee06dc0e26cae8aa57a0cddab7b050db22d3002bd2b0da47d4fd5d78c
Snojan
f7e6d70e5553fb8c221304bf51126f457d4825194c4ef4f98915b28eb9942326
Snojan
+ 30 additional samples on MalwareBazaar
Result
Malware family:
danabot
Create hunting rule
Score:
  10/10
Tags:
family:danabot banker botnet trojan
Link:
https://tria.ge/reports/201109-d4nr3h9dhs/
Behaviour
Suspicious use of WriteProcessMemory
Loads dropped DLL
Blacklisted process makes network request
Danabot
Danabot x86 payload
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Snojan

Executable exe f377512454adebec7f32f1a33bda63e3476595be7857fb73c0e242407f29f616

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/367844/
  
Delivery method
Distributed via web download

Comments