MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 21dbbf625ccd9bf9aae178bf9a5ff84db58aea912166836924b7aa9bbce0443c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DarkVNC


Vendor detections: 9


Intelligence 9 IOCs YARA 3 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 21dbbf625ccd9bf9aae178bf9a5ff84db58aea912166836924b7aa9bbce0443c
SHA3-384 hash: f4c814a3044a9bb83463c312d883bc242d9fd85cad879901f0b57bff6f0b497ce1c93c62522f8b57461b69ed3d7a41df
SHA1 hash: 269434459fefa03f3953eef1884b346610dd1b94
MD5 hash: 1234ece43aa87d86c894c56e624542f1
humanhash: steak-yankee-utah-massachusetts
File name:1234ece43aa87d86c894c56e624542f1
Download: download sample
Signature DarkVNC
Create hunting rule
File size:415'744 bytes
First seen:2021-07-03 10:43:11 UTC
Last seen:2021-07-03 11:39:44 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 50b45b8a27e73c67730edc96d5ef1748 (1 x DarkVNC)
ssdeep 12288:W8rwSDbQw62CyTavhrNs6DI/SnmLjU+IBJ/:W8rw8sw6y2nJmPCZ
TLSH BB940212F703C032CEA511315D99C7A26E7E31314AF9AA4B77444B3A1F753E1BA7A34A
Reporter zbetcheckin
Tags:32 DarkVNC exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
215
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
1234ece43aa87d86c894c56e624542f1
Verdict:
Malicious activity
Analysis date:
2021-07-03 10:44:36 UTC
Tags:
trojan
Link:
https://app.any.run/tasks/5e265a77-296b-4a2d-89e6-5c063854ca6d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.GenericKDZ.76229.30398.23484.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Gootkit
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/621678e6-c842-4c34-9b8f-aa84255edf7a
Result
Threat name:
Ramnit
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/811419
Signature
Allocates memory in foreign processes
Contains functionality to inject threads in other processes
Contains VNC / remote desktop functionality (version string found)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Searches for specific processes (likely to inject)
Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments
Writes to foreign memory regions
Yara detected Ramnit VNC Module
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/21dbbf625ccd9bf9aae178bf9a5ff84db58aea912166836924b7aa9bbce0443c/
Threat name:
Win32.Trojan.Azorult
Create hunting rule
Status:
Malicious
First seen:
2021-07-03 10:44:11 UTC
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ehn36ys4zwn7tkxbpc7zux7yjw2yv2ureftig2jew6vjxphaiq6a._file
Result
Malware family:
darkvnc
Create hunting rule
Score:
  10/10
Tags:
family:darkvnc rat
Link:
https://tria.ge/reports/210703-nd6q4t9rhx/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
DarkVNC Payload
DarkVNC
Suspicious use of NtCreateProcessExOtherParentProcess
Unpacked files
SH256 hash:
59e89d1a41e2cef7fa680f41c5467ba537afd3e17fb35d7fe97e9ee9eefd577b
MD5 hash:
e196835157a10e2a020041ff8b01ae15
SHA1 hash:
f48013e5f5411b2eb98263845fb04c805e9ceb34
Link:
https://www.unpac.me/results/1d108da9-449f-4eca-ace1-4b4f431c2179/
SH256 hash:
4344f3f18ec5afe1aa5ad49d9d59de61a4cd4e8ba7f12115e5699df398a1e19c
MD5 hash:
2a6a791590e90a46abc8169111f355a9
SHA1 hash:
36b2a27ec2cb3ccec0b4aa8cc7fd0aa7efb8693e
Link:
https://www.unpac.me/results/1d108da9-449f-4eca-ace1-4b4f431c2179/
SH256 hash:
21dbbf625ccd9bf9aae178bf9a5ff84db58aea912166836924b7aa9bbce0443c
MD5 hash:
1234ece43aa87d86c894c56e624542f1
SHA1 hash:
269434459fefa03f3953eef1884b346610dd1b94
Link:
https://www.unpac.me/results/1d108da9-449f-4eca-ace1-4b4f431c2179/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/21dbbf625ccd9bf9aae178bf9a5ff84db58aea912166836924b7aa9bbce0443c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:crime_win32_hvnc_banker_gen
Create hunting rule
Author:@VK_Intel
Description:Detects malware banker hidden VNC
Reference:https://twitter.com/VK_Intel/status/1247058432223477760
Rule name:crime_win32_hvnc_zloader1_hvnc_generic
Create hunting rule
Author:@VK_Intel
Description:Detects Zloader hidden VNC
Reference:https://twitter.com/malwrhunterteam/status/1240664014121828352
Rule name:HiddenVNC
Create hunting rule
Author:@bartblaze
Description:Identifies HiddenVNC, which can start remote sessions.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DarkVNC

Executable exe 21dbbf625ccd9bf9aae178bf9a5ff84db58aea912166836924b7aa9bbce0443c

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1422510/

Comments


Avatar
zbet commented on 2021-07-03 10:43:13 UTC

url : hxxp://f0558277.xsph.ru/wizardlogo.exe