MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fddacfe9e490250e62f7f30b944fcbe122e87547d01c4a906401049304c395f7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	fddacfe9e490250e62f7f30b944fcbe122e87547d01c4a906401049304c395f7
SHA3-384 hash:	b58f14fde745c49cd6414d147081c2d2d10114621fd0c65a71de756dadf0f226b078dc17e4aa3e8d17e60707ad64a174
SHA1 hash:	ea1f77423706211132d148e58188823006589aa2
MD5 hash:	b879d804f59086a464dc2bb22a4f5406
humanhash:	hot-nineteen-video-grey
File name:	fn.msi
Download:	download sample
Signature	DanaBot Alert Create hunting rule
File size:	19'652'608 bytes
First seen:	2024-08-19 18:48:06 UTC
Last seen:	2024-08-19 23:35:55 UTC
File type:	msi
MIME type:	application/x-msi
ssdeep	393216:QGjIuCBmV96pYU95IbbW+75yf4mjCa6prMnIJvdvxrpcHQ:QwymV9UB5Iu+0Amj9Y8INtwH
Threatray	3 similar samples on MalwareBazaar
TLSH	T14C1733D680AACF69D0D80432A2D88BD89C733C474B464D55731BBB612DBFDC5BAB118E
TrID	88.4% (.MST) Windows SDK Setup Transform script (61000/1/5) 11.5% (.) Generic OLE2 / Multistream Compound (8000/1)
Reporter	Anonymous
Tags:	DanaBot msi signed

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

106

Origin country :

US

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.BScope.Adware.Puamson.15108.20250.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

70%

Link:

https://cyber-fortress.com/docs/result/index.php?id=66c393a1e7ff3f5a063b93cc

Tags:

Network Stealth

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

crypto fingerprint installer keylogger packed

Link:

https://www.filescan.io/uploads/66c393a164e1aef59a300bfa/reports/311b7c62-adb3-418d-b776-4958d4a30954/overview

Hybrid Analysis Unknown

Verdict:

Suspicious

Link:

https://www.hybrid-analysis.com/sample/fddacfe9e490250e62f7f30b944fcbe122e87547d01c4a906401049304c395f7

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/fddacfe9e490250e62f7f30b944fcbe122e87547d01c4a906401049304c395f7

Joe Sandbox DanaBot

Result

Threat name:

DanaBot

Alert

Create hunting rule

Detection:

malicious

Classification:

phis.troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1495231

Signature

Adds a directory exclusion to Windows Defender

AI detected suspicious sample

Loading BitLocker PowerShell Module

Malicious sample detected (through community Yara rule)

May use the Tor software to hide its network traffic

PE file has a writeable .text section

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Suricata IDS alerts for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Instant Messenger accounts or passwords

Yara detected DanaBot stealer dll

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Susipicious

Score:

39%

Verdict:

Susipicious

File Type:

ARCHIVE

Link:

https://malprob.io/report/fddacfe9e490250e62f7f30b944fcbe122e87547d01c4a906401049304c395f7

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/fddacfe9e490250e62f7f30b944fcbe122e87547d01c4a906401049304c395f7/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7xnm72pesasq4yxx6mfzit6l4eroq5kh2aoevedeaecjgbgdsx3q._file

Threatray malicious

Verdict:

malicious

Similar samples:

7a15dd944f05b7280ae9d297f7707f5ee712821fbae770930bae1539cf9e0b4e

DanaBot

848216011286de7b3a37d2d6c0183f9ca57c6eeaed68069b434c6cc3029a84a6

DanaBot

f0b3e189929f3589c8369ae04343b0c2d8e5d614ae5b6b3a521cf3f843aa8cc7

DanaBot

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  9/10

Tags:

collection credential_access discovery evasion execution persistence privilege_escalation spyware stealer

Link:

https://tria.ge/reports/240819-xgb4satfrq/

Behaviour

Checks SCSI registry key(s)

Checks processor information in registry

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Volume Shadow Copy service COM API

outlook_office_path

outlook_win_path

Enumerates physical storage devices

Event Triggered Execution: Installer Packages

Event Triggered Execution: Netsh Helper DLL

System Location Discovery: System Language Discovery

Checks installed software on the system

Drops file in Windows directory

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Accesses Microsoft Outlook accounts

Accesses Microsoft Outlook profiles

Adds Run key to start application

Blocklisted process makes network request

Enumerates connected drives

Modifies Windows Firewall

Reads WinSCP keys stored on the system

Reads user/profile data of web browsers

Command and Scripting Interpreter: PowerShell

Credentials from Password Stores: Credentials from Web Browsers

Threat.Zone Suspicious

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/b913679a-7431-4aaa-822e-0212c6b51be3

VMRay Malicious

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/fddacfe9e490/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/fddacfe9e490250e62f7f30b944fcbe122e87547d01c4a906401049304c395f7