MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4b1b26a4b42e7a0198b3aaccede9293a760f7f1b4f373480be1c4bb33b2f74c6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

DarkGate

Vendor detections: 5

Intelligence 5 IOCs YARA 7 File information Comments

SHA256 hash:	4b1b26a4b42e7a0198b3aaccede9293a760f7f1b4f373480be1c4bb33b2f74c6
SHA3-384 hash:	74df13403b8aaa0e98ab06c99c40933fdd0d084dedd362c80c4f7197d30665190c2112d51d4bf5b65032c3199e4a6d72
SHA1 hash:	5de8cd22d0211e48be6ca3c952882679f10859d6
MD5 hash:	16cc62500e41d7cda7eb1c2b5f69fc1b
humanhash:	diet-harry-speaker-yankee
File name:	download.zip
Download:	download sample
Signature	DarkGate Create hunting rule
File size:	1'963'184 bytes
First seen:	2024-01-24 16:57:31 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	49152:aqJlu2V32eDkK+1cOQv6UrcPHyd17Sdwe4sD:RJlRf4cJo/yd1/sD
TLSH	T1AD9533BF4F1F1109946A2D0CA1E865AF279916F9D5B2F783AC68441FC4DFE9B6708308
TrID	80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	e24111111111111
Tags:	DarkGate zip

e24111111154168

http://5.181.159.64/Downloads/8GMgV5a1fsLKxv.zip/

Intelligence

File Origin

# of uploads :

# of downloads :

271

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	8GMgV5a1fsLKxv.msi
File size:	4'493'312 bytes
SHA256 hash:	e5e94056346367f7a8cf31fd7a2a47b4004623f1c8b74cb8f5d6ae110bef134a
MD5 hash:	643541e25802b30249ba4fd2f549e244
MIME type:	application/x-msi
Signature	DarkGate

Vendor Threat Intelligence

Verdict:

No Threat

Threat level:

2.5/10

Confidence:

100%

Tags:

anti-vm expand fingerprint installer lolbin packed shell32

Link:

https://www.filescan.io/uploads/65b1419eeda27a7ac10109a9/reports/f2b72eb2-625b-45cc-a752-036eb0e76319/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/4b1b26a4b42e7a0198b3aaccede9293a760f7f1b4f373480be1c4bb33b2f74c6

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/4b1b26a4b42e7a0198b3aaccede9293a760f7f1b4f373480be1c4bb33b2f74c6

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4b1b26a4b42e7a0198b3aaccede9293a760f7f1b4f373480be1c4bb33b2f74c6/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=jmnsnjfufz5adgftvlgo32jjhj3a67y3j43tjaf6drf3gozpotda._file

Result

Malware family:

n/a

Score:

7/10

Tags:

discovery

Link:

https://tria.ge/reports/240124-vmdtfsead2/

Behaviour

Checks SCSI registry key(s)

Checks processor information in registry

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Uses Volume Shadow Copy service COM API

Drops file in Windows directory

Enumerates connected drives

Executes dropped EXE

Loads dropped DLL

Modifies file permissions

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

DarkGate

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/4b1b26a4b42e7a0198b3aaccede9293a760f7f1b4f373480be1c4bb33b2f74c6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AutoIT_Script Create hunting rule
Author:	@bartblaze
Description:	Identifies AutoIT script. This rule by itself does NOT necessarily mean the detected file is malicious.

Rule name:	BitcoinAddress Create hunting rule
Author:	Didier Stevens (@DidierStevens)
Description:	Contains a valid Bitcoin address

Rule name:	Borland Create hunting rule
Author:	malware-lu

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	maldoc_OLE_file_magic_number Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	SUSP_XORed_MSDOS_Stub_Message Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious XORed MSDOS stub message
Reference:	https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings