MALICIOUS — 4084cf6e810a6cd921559e47e565c22497e7ad41a68321515fa146edbadfc9d7

MALICIOUS — 4084cf6e810a6cd921559e47e565c22497e7ad41a68321515fa146edbadfc9d7 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (89/100), attributed to the Danabot family. 5 of 52 detection engines flagged it.

Identification

• SHA-256: 4084cf6e810a6cd921559e47e565c22497e7ad41a68321515fa146edbadfc9d7
• SHA-1: 46f00c5b41c5f92f8ba1ff7b3c3f91bf505d303c
• MD5: 0d7e60f6655571fd62d85290f4f8ec91
• imphash: f9e81afd2870aaecd8ace36b2893b1d3
• ssdeep: 24576:+ncFdNnR0zGhv69VV40Y1d/UwnHNG6S0UzB67quGxTtxr8:tNRNHd7nt2aebT3
• TLSH: T149565CDF5B1B3602D73ECBD56162BD7E04FBE84B13B7584880EA861EC7E48232560919
• Submitted as: 4084cf6e810a6cd921559e47e565c22497e7ad41a68321515fa146edbadfc9d7
• File type: pe · Size: 1405952 bytes
• Verdict: malicious (89/100) · Family: Danabot

Detections (5 of 52 engines)

• ClamAV (daily): Win.Spyware.Danabot-9910299-0
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• Microsoft Defender: Trojan:Win32/Danabot!pz
• Emsisoft (Emergency Kit): Trojan-Spy.Danabot
• Kaspersky (KVRT): Trojan-Banker.Win32.Danabot.ksa

Why this verdict

The malicious score of 89/100 is the fusion of 2 weighted signals:

• ClamAV (daily) flagged Win.Spyware.Danabot-9910299-0 (rule Win.Spyware.Danabot-9910299-0) - engine signal, weight 0.90, confidence 0.95
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

File paths

• X:\:`:d:h:l:p:t:
• X:\:x:
• X:\:`:d:h:l:p:t:x:
• T:\:`:d:h:l:p:t:x:
• X:\:`:d:h:l:p:~:
• S:\:s:
• F:\:y:
• X:\:`:d:h:p:
• N:\:i:{:
• P:\:`:d:p:t:x:
• X:\:`:d:q:
• W:\:a:f:n:s:{:
• R:\:a:f:k:q:v:
• M:\:w:
• V:\:a:f:k:p:u:z:
• X:\:d:h:l:p:t:x:
• T:\:d:l:t:

More Danabot samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report