danabot | 9a9c29b7c86f85ba69867fe9eca96032

Sharing

Copy URL Twitter E-mail

General

Target

9a9c29b7c86f85ba69867fe9eca96032
Size

17.5MB
MD5

9a9c29b7c86f85ba69867fe9eca96032
SHA1

f04ac642fd12828ff29ee7a80dca4fc06e9e9ed6
SHA256

21917cd411471ca69b1c99e31021daca3abb99230847fabd831efa9f262c9d91
SHA512

0d1020d9ea58c043d79dedc277f499712cced5525e376148e790b0b822f8997553a3d971eddb5dcf5f7c91c32ce76332e2d82bc9c1b9adfaed7ae31fd173e050
SSDEEP

393216:09au43eWk/QTynLEuIGw5Eio0Puxj/792+rOZTlEwLNPFqCxnhmq:0cRjTynLOc/tglEwLNPFqCxnh3

Score

10^/10

15 danabot

Malware Config

Extracted

Family

danabot

Version

1987

Botnet

192.52.166.169:443

173.254.204.95:443

192.52.167.45:443

Attributes

embedded_hash
D6A9A294BFDC6F13BFCC2AB0FA9B54B9
type
main

rsa_privkey.plain

rsa_pubkey.plain

Signatures

Danabot family
danabot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9a9c29b7c86f85ba69867fe9eca96032

Files

9a9c29b7c86f85ba69867fe9eca96032
.dll windows:5 windows x86 arch:x86

908afa7baa08116e817d0ade28b27ef3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Imports

oleaut32

SysFreeString
SysReAllocStringLen
SysAllocStringLen
SafeArrayPtrOfIndex
SafeArrayPutElement
SafeArrayGetElement
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreate
VariantChangeType
VariantCopyInd
VariantCopy
VariantClear
VariantInit
CreateErrorInfo
GetErrorInfo
SetErrorInfo
SysFreeString

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey
SetThreadToken
SetSecurityDescriptorDacl
ReportEventA
RegisterEventSourceA
RegUnLoadKeyW
RegSetValueExW
RegSaveKeyW
RegRestoreKeyW
RegReplaceKeyW
RegQueryValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegOpenKeyW
RegLoadKeyW
RegFlushKey
RegEnumValueW
RegEnumKeyW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegConnectRegistryW
RegCloseKey
OpenThreadToken
OpenProcessToken
LookupPrivilegeValueW
LookupAccountSidW
LookupAccountNameW
IsValidSid
IsTextUnicode
InitializeSecurityDescriptor
GetUserNameW
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
GetSecurityDescriptorSacl
GetCurrentHwProfileW
FreeSid
EqualSid
DuplicateToken
DeregisterEventSource
AllocateAndInitializeSid
AdjustTokenPrivileges
CryptEnumProvidersA
CryptSignHashA
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptGenKey
CryptReleaseContext
CryptAcquireContextW
CryptAcquireContextA
LsaFreeMemory
LsaClose
LsaRetrievePrivateData
LsaOpenPolicy
ConvertSidToStringSidA
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextW
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityInfo
SetSecurityInfo
ConvertStringSecurityDescriptorToSecurityDescriptorW
CryptSignHashA
CryptVerifySignatureW
CryptDecrypt
CryptImportKey
CryptEncrypt
CryptDeriveKey
CryptDestroyKey
CryptExportKey
CryptGenKey
CryptReleaseContext
CryptDestroyHash
CryptGetHashParam
CryptHashData
CryptCreateHash
CryptAcquireContextA

user32

CharNextW
LoadStringW
SetWindowLongA
GetWindowLongA
SetWindowLongW
GetWindowLongW
CreateWindowExW
wvsprintfW
mouse_event
keybd_event
WindowFromPoint
UpdateWindow
UnregisterClassW
TranslateMessage
SystemParametersInfoW
ShowWindow
SetWindowPos
SetTimer
SetThreadDesktop
SetClipboardData
SendMessageA
SendMessageW
ScreenToClient
ReleaseDC
RegisterWindowMessageW
RegisterClassW
RealGetWindowClassW
PtInRect
PostThreadMessageW
PostMessageA
PostMessageW
PeekMessageW
OpenDesktopW
OpenClipboard
MsgWaitForMultipleObjectsEx
MsgWaitForMultipleObjects
MoveWindow
MessageBoxA
MessageBoxW
MenuItemFromPoint
LoadStringW
LoadIconW
LoadCursorW
KillTimer
IsWindowVisible
IsWindow
InvalidateRect
GetWindowThreadProcessId
GetWindowTextW
GetWindowRect
GetWindowPlacement
GetWindowInfo
GetUserObjectInformationW
GetTopWindow
GetThreadDesktop
GetSystemMetrics
GetProcessWindowStation
GetWindow
GetMessageW
GetMenuItemID
GetKeyboardLayoutList
GetForegroundWindow
GetDesktopWindow
GetDC
GetCursorInfo
GetClipboardData
GetClassNameW
GetClassInfoW
GetAncestor
FrameRect
FindWindowExW
FindWindowA
FindWindowW
EnumDesktopWindows
EndDeferWindowPos
DrawIcon
DispatchMessageW
DestroyWindow
DeferWindowPos
DefWindowProcW
CreateDesktopW
CloseDesktop
CloseClipboard
ChildWindowFromPoint
CharUpperBuffW
CharUpperW
CharLowerBuffW
BeginDeferWindowPos
PrintWindow
PrintWindow

kernel32

Sleep
VirtualFree
VirtualAlloc
lstrlenW
VirtualQuery
QueryPerformanceCounter
GetTickCount
GetSystemInfo
GetVersion
CompareStringW
IsValidLocale
SetThreadLocale
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GetLocaleInfoW
WideCharToMultiByte
MultiByteToWideChar
GetACP
LoadLibraryExW
GetStartupInfoW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetCommandLineW
FreeLibrary
GetLastError
UnhandledExceptionFilter
RtlUnwind
RaiseException
ExitProcess
ExitThread
SwitchToThread
GetCurrentThreadId
CreateThread
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
FindFirstFileW
FindClose
SetCurrentDirectoryW
GetCurrentDirectoryW
WriteFile
GetStdHandle
CloseHandle
GetProcAddress
RaiseException
LoadLibraryA
GetLastError
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
LocalFree
LocalAlloc
FreeLibrary
lstrlenW
lstrcpyA
lstrcpyW
lstrcmpW
lstrcatW
WriteProcessMemory
WritePrivateProfileStringW
WriteFile
WideCharToMultiByte
WaitForSingleObjectEx
WaitForSingleObject
WaitForMultipleObjectsEx
VirtualQueryEx
VirtualQuery
VirtualProtect
VirtualFreeEx
VirtualFree
VirtualAllocEx
VirtualAlloc
VerSetConditionMask
VerifyVersionInfoW
UnmapViewOfFile
UnlockFileEx
UnlockFile
TryEnterCriticalSection
TerminateThread
TerminateProcess
SystemTimeToFileTime
SwitchToThread
SuspendThread
Sleep
SetThreadPriority
SetPriorityClass
SetLastError
SetFileTime
SetFilePointerEx
SetFilePointer
SetFileAttributesW
SetEvent
SetEndOfFile
SetCurrentDirectoryW
ResumeThread
ResetEvent
RemoveDirectoryW
ReleaseSemaphore
ReadFile
RaiseException
QueryPerformanceFrequency
QueryPerformanceCounter
QueryDosDeviceW
IsDebuggerPresent
OutputDebugStringA
OutputDebugStringW
OpenProcess
OpenEventW
MultiByteToWideChar
MapViewOfFile
LockFileEx
LockFile
LocalFree
LocalAlloc
LoadLibraryA
LoadLibraryW
LeaveCriticalSection
LCMapStringW
IsValidLocale
IsBadReadPtr
InitializeCriticalSection
HeapValidate
HeapSize
HeapReAlloc
HeapFree
HeapDestroy
HeapCreate
HeapCompact
HeapAlloc
GlobalUnlock
GlobalSize
GlobalMemoryStatusEx
GlobalMemoryStatus
GlobalLock
GlobalFree
GlobalAlloc
GetWindowsDirectoryW
GetVolumeInformationW
GetVersionExA
GetVersionExW
GetVersion
GetUserDefaultLangID
GetTimeZoneInformation
GetTickCount
GetThreadPriority
GetThreadLocale
GetTempPathA
GetTempPathW
GetTempFileNameW
GetSystemTimeAsFileTime
GetSystemTime
GetSystemPowerStatus
GetSystemInfo
GetSystemDirectoryW
GetSystemDefaultLangID
GetStdHandle
GetLongPathNameW
GetShortPathNameW
GetProcessHeap
GetProcAddress
GetPrivateProfileStringW
GetPrivateProfileIntW
GetModuleHandleA
GetModuleHandleW
GetModuleFileNameW
GetLogicalDrives
GetLogicalDriveStringsW
GetLocaleInfoW
GetLocalTime
GetLastError
GetFullPathNameA
GetFullPathNameW
GetFileType
GetFileSizeEx
GetFileSize
GetFileAttributesExW
GetFileAttributesA
GetFileAttributesW
GetExitCodeThread
GetExitCodeProcess
GetEnvironmentVariableW
GetDriveTypeW
GetDiskFreeSpaceExW
GetDiskFreeSpaceA
GetDiskFreeSpaceW
GetDateFormatW
GetCurrentThreadId
GetCurrentThread
GetCurrentProcessId
GetCurrentProcess
GetCurrentDirectoryW
GetComputerNameExW
GetComputerNameW
GetCPInfoExW
GetCPInfo
GetBinaryTypeW
GetACP
FreeLibrary
FormatMessageA
FormatMessageW
FlushViewOfFile
FlushInstructionCache
FlushFileBuffers
FlushConsoleInputBuffer
FindNextFileA
FindNextFileW
FindFirstFileA
FindFirstFileW
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
FileTimeToDosDateTime
ExitThread
EnumSystemLocalesW
EnumCalendarInfoW
EnterCriticalSection
DisconnectNamedPipe
DeleteFileA
DeleteFileW
DeleteCriticalSection
CreateThread
CreateSemaphoreA
CreateRemoteThread
CreateProcessW
CreateNamedPipeW
CreateMutexW
CreateFileMappingW
CreateFileA
CreateFileW
CreateEventA
CreateEventW
CreateDirectoryW
CopyFileW
ConnectNamedPipe
CompareStringW
CloseHandle
AreFileApisANSI
Sleep
Wow64EnableWow64FsRedirection
Wow64DisableWow64FsRedirection

gdi32

StretchBlt
SetStretchBltMode
SelectObject
Rectangle
GetStockObject
GetPixel
GetObjectA
GetDeviceCaps
GetDIBits
DeleteObject
DeleteDC
CreatePen
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

mpr

WNetOpenEnumW
WNetEnumResourceW
WNetCloseEnum

netapi32

NetApiBufferFree
NetWkstaGetInfo
Netbios

ole32

OleInitialize
CreateBindCtx
MkParseDisplayName
CoGetObject
CoTaskMemFree
CLSIDFromProgID
IIDFromString
CLSIDFromString
StringFromCLSID
CoCreateInstance
CoUninitialize
CoInitializeEx
CoInitialize

ws2_32

WSAIoctl
WSAEventSelect
WSAGetLastError
WSASetLastError
WSACleanup
WSAStartup
getservbyname
gethostbyname
socket
shutdown
setsockopt
send
select
recv
ntohs
ntohl
listen
inet_addr
htons
htonl
getsockopt
getsockname
ioctlsocket
connect
closesocket
bind
accept
__WSAFDIsSet

shell32

ShellExecuteExW
SHAppBarMessage
SHGetFolderPathW
SHGetSpecialFolderPathW
SHGetSpecialFolderPathW
SHGetPathFromIDListW
SHGetSpecialFolderLocation

wininet

InternetSetOptionW
InternetCrackUrlW

msvcrt

realloc
_ftol
memmove
memcmp
free
malloc
strncmp
memset
strlen
memcpy
localtime
_errno
memchr
strcmp
strerror
realloc
_ftol
strncpy
strcat
isdigit
isxdigit
memmove
printf
tolower
isupper
isspace
memcmp
free
malloc
atol
_stricmp
strchr
strncmp
memset
strlen
memcpy
toupper
abort
signal
_getch
setvbuf
getenv
strstr
sprintf
_exit
raise
_vsnprintf
wcsstr
strtol
fflush
fputs
time
fwrite
strrchr
strtoul
sscanf
fprintf
_stat
ftell
fread
fopen
_lseek
_write
_read
_close
wcslen
_getpid
isalnum
localtime
gmtime
calloc
_chmod
_fdopen
_open
fclose
qsort
fseek
_strnicmp
fgets
_setmode
_wfopen
memset
memmove
memcpy
_beginthreadex

esent

JetIndexRecordCount
JetMove
JetRetrieveColumns
JetOpenTableW
JetOpenDatabaseW
JetGetColumnInfoW
JetAttachDatabaseW
JetEndSession
JetBeginSessionW
JetSetSystemParameterW
JetTerm
JetCreateInstanceW
JetInit

crypt32

CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CertCreateSelfSignCertificate
CertOpenSystemStoreW
CertGetNameStringW
CertStrToNameW
CertNameToStrW
CryptExportPKCS8
CryptAcquireCertificatePrivateKey
CryptExportPublicKeyInfoEx
CryptSignAndEncodeCertificate
CertAddCertificateContextToStore
CertGetCertificateContextProperty
CertFreeCertificateContext
CertCreateCertificateContext
CertDuplicateCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CryptEncodeObject
PFXExportCertStoreEx
CryptBinaryToStringA
CryptStringToBinaryA

iphlpapi

GetAdaptersInfo

winspool.drv

GetDefaultPrinterW

rasapi32

RasGetEntryDialParamsA
RasEnumEntriesA

cryptui

CryptUIDlgViewCertificateW

shlwapi

StrStrW

ntdll

RtlCompressBuffer
RtlGetCompressionWorkSpaceSize
RtlAllocateHeap
RtlDecompressBuffer
LdrEnumerateLoadedModules
RtlReleasePebLock
RtlAcquirePebLock
RtlGetCurrentPeb
NtFreeVirtualMemory
NtAllocateVirtualMemory
NtQueryValueKey
NtEnumerateValueKey
NtOpenKey
RtlQueryElevationFlags
NtQueryInformationToken
NtOpenProcessToken
RtlGetVersion
RtlDestroyHeap
RtlFreeHeap
RtlAllocateHeap
RtlCreateHeap
RtlNtStatusToDosError
RtlEqualUnicodeString
RtlInitUnicodeString
NtClose

Exports

Exports

TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr

Sections

.text
Size: 14.0MB - Virtual size: 14.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.itext
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 1.1MB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 68B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 287KB - Virtual size: 286KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

908afa7baa08116e817d0ade28b27ef3

Headers

File Characteristics

Imports

oleaut32

advapi32

user32

kernel32

gdi32

version

mpr

netapi32

ole32

ws2_32

shell32

wininet

msvcrt

esent

crypt32

iphlpapi

winspool.drv

rasapi32

cryptui

shlwapi

ntdll

Exports

Exports

Sections

.text Size: 14.0MB - Virtual size: 14.0MB

.itext Size: 8KB - Virtual size: 7KB

.data Size: 3.1MB - Virtual size: 3.1MB

.bss Size: - Virtual size: 1.1MB

.idata Size: 19KB - Virtual size: 18KB

.didata Size: 1KB - Virtual size: 1KB

.edata Size: 512B - Virtual size: 152B

.rdata Size: 512B - Virtual size: 68B

.reloc Size: 287KB - Virtual size: 286KB

.rsrc Size: 22KB - Virtual size: 22KB

.text
Size: 14.0MB - Virtual size: 14.0MB

.itext
Size: 8KB - Virtual size: 7KB

.data
Size: 3.1MB - Virtual size: 3.1MB

.bss
Size: - Virtual size: 1.1MB

.idata
Size: 19KB - Virtual size: 18KB

.didata
Size: 1KB - Virtual size: 1KB

.edata
Size: 512B - Virtual size: 152B

.rdata
Size: 512B - Virtual size: 68B

.reloc
Size: 287KB - Virtual size: 286KB

.rsrc
Size: 22KB - Virtual size: 22KB