MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 36c3f84840f35bc9d7da33c1d8d4121cac9e6c9635e55e385bf1e26ef1c50737. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

DarkVNC

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments 1

SHA256 hash:	36c3f84840f35bc9d7da33c1d8d4121cac9e6c9635e55e385bf1e26ef1c50737
SHA3-384 hash:	67501a7f050370545806c98b117f8cdea31ce0b70737fee0ab32e3f6380ea9fdb2a120c7f40f8a8a4d9b6f5f7d9176f7
SHA1 hash:	c9fa11a0e6050bd1e441c443969c266374e74762
MD5 hash:	73ccd3a4b2fdad29e93c7aa9281a6cb1
humanhash:	indigo-yellow-low-carpet
File name:	73ccd3a4b2fdad29e93c7aa9281a6cb1
Download:	download sample
Signature	DarkVNC Create hunting rule
File size:	1'174'528 bytes
First seen:	2021-07-09 04:31:52 UTC
Last seen:	2021-07-09 05:50:30 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	1dd63394b7581f644406e79aaff7117c (2 x DarkVNC)
ssdeep	24576:nTncT5y/Lp2DIKB0dw2Hs8ThlIWNFCCbuxoxh7H6:TnirB0dbsGhXr3W
Threatray	29 similar samples on MalwareBazaar
TLSH	T1064502106AB0D039E5B322F84575A3A8972D7EB15F7040CBE2D526DE97346E0EDB1317
Reporter	zbetcheckin
Tags:	32 DarkVNC exe

Intelligence

File Origin

# of uploads :

# of downloads :

145

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

73ccd3a4b2fdad29e93c7aa9281a6cb1

Verdict:

Malicious activity

Analysis date:

2021-07-09 04:33:05 UTC

Tags:

trojan danabot

Link:

https://app.any.run/tasks/8ad8b1b4-f82a-4729-93f2-0b546e6ff9f7

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/170600/

Detection(s):

SecuriteInfo.com.W32.AIDetect.malware1.23968.14297.UNOFFICIAL

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Malicious Packer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/8bf90c0f-36e6-4504-88a7-79afb9a07570

Result

Threat name:

DarkVNC

Detection:

malicious

Classification:

troj.evad

Score:

92 / 100

Link:

https://www.joesandbox.com/analysis/813853

Signature

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Machine Learning detection for sample

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Yara detected DarkVNC

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/36c3f84840f35bc9d7da33c1d8d4121cac9e6c9635e55e385bf1e26ef1c50737/

Threat name:

Win32.Trojan.Zenpak

Status:

Malicious

First seen:

2021-07-09 04:32:06 UTC

AV detection:

17 of 46 (36.96%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=g3b7qsca6nn4tv62gpa5rvasdswj43ewgxsv4oc36hrg54ofa43q._file

Verdict:

unknown

Result

Malware family:

n/a

Score:

8/10

Tags:

n/a

Link:

https://tria.ge/reports/210709-zsgzrlalbx/

Behaviour

Suspicious use of WriteProcessMemory

Loads dropped DLL

Blocklisted process makes network request

Unpacked files

SH256 hash:

fb4895acc0553f810caf3a6d26a4eb7af18934571ff21b05a2ac07232a226bc9

MD5 hash:

fe7ba6f8c484342ddd60c5e99fd5cea9

SHA1 hash:

c809081cfc879d6428dffc9c536c32f86318a319

Link:

https://www.unpac.me/results/e3c049a2-e140-4884-9c14-042d54b4775e/

SH256 hash:

d27aa25e64b9c4e20f31a8c2f7f3123d1875f30f72586af4d0877e518c4ddd60

MD5 hash:

681a9e9ba143f493e4ea3d9b74ae5b55

SHA1 hash:

dc7be8d7c44ced20713b176820fe18176435e389

Link:

https://www.unpac.me/results/e3c049a2-e140-4884-9c14-042d54b4775e/

SH256 hash:

36c3f84840f35bc9d7da33c1d8d4121cac9e6c9635e55e385bf1e26ef1c50737

MD5 hash:

73ccd3a4b2fdad29e93c7aa9281a6cb1

SHA1 hash:

c9fa11a0e6050bd1e441c443969c266374e74762

Link:

https://www.unpac.me/results/e3c049a2-e140-4884-9c14-042d54b4775e/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/36c3f84840f35bc9d7da33c1d8d4121cac9e6c9635e55e385bf1e26ef1c50737

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture Create hunting rule
Author:	ditekSHen
Description:	Detect executables with stomped PE compilation timestamp that is greater than local current time