MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 186d9c0570ab746e82adf1c11e9dacfd66952958192e7e6cfd03561e2a66053f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

DarkGate

Vendor detections: 4

Intelligence 4 IOCs YARA 5 File information Comments

SHA256 hash:	186d9c0570ab746e82adf1c11e9dacfd66952958192e7e6cfd03561e2a66053f
SHA3-384 hash:	62c9db0a7a68afc7624b29be66db286c693ff986114973716f5b8a3c008a260cca3470164af08fe9d6ed7aec8005dd6b
SHA1 hash:	ef417a7d3150b21c7981ff5ff828420f6335d082
MD5 hash:	b057b73c7ff013c0abdb0be46df52460
humanhash:	crazy-sodium-oregon-saturn
File name:	prtyhguafelif.zip
Download:	download sample
Signature	DarkGate Create hunting rule
File size:	2'014'946 bytes
First seen:	2024-01-24 17:41:21 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	49152:39XX8g8yIK0ZVKwywUvde27iWw0hrE2OmXTNDtVixp8uNKJH:39dKGv1b7Uf2ZXTNnuvK1
TLSH	T13A9533FFD62D384A10CFA459A6F2EE8B1749053508DBE2853F43C737A42B99F9A8D111
TrID	80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	e24111111111111
Tags:	DarkGate zip

Intelligence

File Origin

# of uploads :

# of downloads :

282

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	prtyhguafelif.msi
File size:	4'497'408 bytes
SHA256 hash:	3c130dd5bfba46230e49a87522411f716c4ef5ce8ff3c60ef450c5c5c2e75f45
MD5 hash:	34d86486c3fa02eee70fc0c0d4eefefe
MIME type:	application/x-msi
Signature	DarkGate

Vendor Threat Intelligence

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

anti-vm expand fingerprint installer lolbin packed shell32

Link:

https://www.filescan.io/uploads/65b14bed1dcf0cd54471c84d/reports/f6ba4b41-b4da-4131-8f36-9c13ef0dc95d/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/186d9c0570ab746e82adf1c11e9dacfd66952958192e7e6cfd03561e2a66053f

Score:

Verdict:

Benign

File Type:

Result

Malware family:

n/a

Score:

7/10

Tags:

discovery

Link:

https://tria.ge/reports/240124-xhgewsfgg4/

Behaviour

Checks SCSI registry key(s)

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Uses Volume Shadow Copy service COM API

Drops file in Windows directory

Enumerates connected drives

Executes dropped EXE

Loads dropped DLL

Modifies file permissions

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

DarkGate

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/186d9c0570ab746e82adf1c11e9dacfd66952958192e7e6cfd03561e2a66053f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AutoIT_Script Create hunting rule
Author:	@bartblaze
Description:	Identifies AutoIT script. This rule by itself does NOT necessarily mean the detected file is malicious.

Rule name:	Borland Create hunting rule
Author:	malware-lu

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	maldoc_OLE_file_magic_number Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample