MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 573d3e739227f741344484f94d246c23318ac5329bf739d4ec396e0d5acf2ffa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DarkGate


Vendor detections: 6


Intelligence 6 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 573d3e739227f741344484f94d246c23318ac5329bf739d4ec396e0d5acf2ffa
SHA3-384 hash: 260b9266996a5399f7f72f205e4472ec04bebce212c5247541342a597974235ecdd95b190d562d58f91685acc3bb8649
SHA1 hash: 76c4dfedd119860104e748f5722208ed7c16399b
MD5 hash: 96f273de5cbe4df4e0dc37ae76307930
humanhash: ceiling-comet-sodium-winner
File name:ipscan.msi
Download: download sample
Signature DarkGate
Create hunting rule
File size:23'085'056 bytes
First seen:2023-08-21 08:22:20 UTC
Last seen:Never
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 393216:ACNptYoynoKXCzVsUdBz+fdpdvkh8QdJt/OwMHk3eyU/3O1WCN2+eNNLONpuBGio:ACNpino2ovd0/vkNt/Owne3/O18T3o
Threatray 243 similar samples on MalwareBazaar
TLSH T1D43733A236E99F3BF45C247D9461CAB8B0A75C1467B1C0EF338677145A760A0AB7730E
TrID 89.6% (.MSI) Microsoft Windows Installer (454500/1/170)
8.7% (.MSP) Windows Installer Patch (44509/10/5)
1.5% (.) Generic OLE2 / Multistream Compound (8000/1)
Reporter JAMESWT_WT
Tags:83-217-9-18 DarkGate msi

Intelligence

File Origin
# of uploads :
1
# of downloads :
159
Origin country :
IT IT
Vendor Threat Intelligence
Verdict:
No Threat
Threat level:
  10/10
Confidence:
100%
Tags:
expand fingerprint lolbin packed shell32
Link:
https://www.filescan.io/uploads/64e31ee82a89064e5594a046/reports/12cf28c5-28d7-4a96-bcf6-be5521d31351/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/573d3e739227f741344484f94d246c23318ac5329bf739d4ec396e0d5acf2ffa
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/573d3e739227f741344484f94d246c23318ac5329bf739d4ec396e0d5acf2ffa
Result
Threat name:
Darkgate
Create hunting rule
Detection:
malicious
Classification:
spre.troj.spyw.evad
Score:
40 / 100
Link:
https://www.joesandbox.com/analysis/1294379
Signature
Contains functionality to detect sleep reduction / modifications
Contains functionality to modify clipboard data
Creates a thread in another existing process (thread injection)
Sample uses string decryption to hide its real strings
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected Advanced IP Scanner Hacktool
Yara detected Darkgate
Yara detected WebBrowserPassView password recovery tool
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1294379 Sample: ipscan.msi Startdate: 21/08/2023 Architecture: WINDOWS Score: 40 99 Yara detected Darkgate 2->99 101 Yara detected Advanced IP Scanner Hacktool 2->101 103 Sample uses string decryption to hide its real strings 2->103 105 4 other signatures 2->105 11 msiexec.exe 205 192 2->11         started        14 Autoit3.exe 2->14         started        16 msiexec.exe 3 2->16         started        process3 file4 85 C:\...\advanced_ip_scanner.exe, PE32 11->85 dropped 87 C:\Windows\Installer\MSIB86.tmp, PE32 11->87 dropped 89 C:\Windows\Installer\MSI7092.tmp, PE32 11->89 dropped 91 58 other files (none is malicious) 11->91 dropped 18 msiexec.exe 5 11->18         started        20 msiexec.exe 11->20         started        22 msiexec.exe 11->22         started        24 cmd.exe 14->24         started        process5 process6 26 AutoIt3.exe 8 18->26         started        30 expand.exe 35 18->30         started        32 icacls.exe 18->32         started        34 icacls.exe 18->34         started        file7 75 C:\temp\AutoIt3.exe, PE32 26->75 dropped 109 Contains functionality to modify clipboard data 26->109 36 cmd.exe 26->36         started        41 dataAdvanced_IP_Scanner_2.5.4594.1.exe 2 26->41         started        43 cmd.exe 26->43         started        45 cmd.exe 26->45         started        77 C:\Users\user\AppData\...\mspatchc.dll (copy), PE32 30->77 dropped 79 C:\Users\user\AppData\...\mergemod.dll (copy), PE32 30->79 dropped 81 C:\Users\user\AppData\...\melt.exe (copy), PE32 30->81 dropped 83 33 other files (none is malicious) 30->83 dropped signatures8 process9 dnsIp10 93 107.181.161.200, 443, 49163, 49165 TOTAL-SERVER-SOLUTIONSUS United States 36->93 65 C:\ProgramData\hefcddb\Autoit3.exe, PE32 36->65 dropped 107 Creates a thread in another existing process (thread injection) 36->107 47 armsvc.exe 36->47         started        49 MyProg.exe 36->49         started        51 ADelRCP.exe 36->51         started        67 C:\...\dataAdvanced_IP_Scanner_2.5.4594.1.tmp, PE32 41->67 dropped 53 dataAdvanced_IP_Scanner_2.5.4594.1.tmp 5 13 41->53         started        56 advanced_ip_scanner.exe 41->56         started        file11 signatures12 process13 file14 58 AcroBroker.exe 47->58         started        69 C:\Users\user\...\aips_is_install_dll.dll, PE32 53->69 dropped 71 C:\Users\user\AppData\Local\...\_shfoldr.dll, PE32 53->71 dropped 73 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 53->73 dropped 60 advanced_ip_scanner.exe 53->60         started        process15 dnsIp16 95 advanced-ip-scanner.com 188.40.30.100, 49179, 80 HETZNER-ASDE Germany 60->95 97 www.advanced-ip-scanner.com 60->97 63 Wkconv.exe 60->63         started        process17
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=k46t444se73ucnceqt4u2jdmemyyvrjstp3ttvhmhfxa2wwpf75a._file
Verdict:
suspicious
Similar samples:
01b9345b7e3afeb6e5d3a32317baa63a8702158fc79a79c065584d30b083d1c9
DarkGate
033cafb9fcd3d50d858164c117ee2a1c9e7fe95b4d027315bc9d1186e655d583
DarkGate
1336315ea7204e103af425ee84a162700bfe6efc48dbc823e8b04f0e246cb288
DarkGate
3dff203bab1db4bd7012e5daa23e467f7919587e5a306e497edb85caa2497dbe
DarkGate
ac8ba32c27d3dc8fa0eef48f3d3de5032df74dd476cf0669f92fecd617c4e10d
DarkGate
b4bbdadeb876d22140beabe77e143cd74871461c0823f9f9ba79b41106386d26
DarkGate
b8254f6435b125aa27f14b554aa14404d3bb1a55a9e659acd4eb22fc6e8abb80
DarkGate
bfe85700c95ee65a50c47769f003c792d9b7cc407359a6d6df795c3bbb3fef8b
DarkGate
ef2cda3a12c765e1311e63e4485f286f66db64e0a28cb1b26af360c933cfcf36
DarkGate
fdc0ccb5bd0267845485e0716a802a2552c919b659ebdfb272e3ad33379cb570
DarkGate
+ 233 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
discovery
Link:
https://tria.ge/reports/230821-j951nsdf51/
Behaviour
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Windows directory
Suspicious use of SetThreadContext
Enumerates connected drives
Executes dropped EXE
Loads dropped DLL
Modifies file permissions
Drops startup file
Blocklisted process makes network request
Suspicious use of NtCreateUserProcessOtherParentProcess
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/573d3e739227/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/573d3e739227f741344484f94d246c23318ac5329bf739d4ec396e0d5acf2ffa

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:maldoc_OLE_file_magic_number
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DarkGate

Microsoft Software Installer (MSI) msi 573d3e739227f741344484f94d246c23318ac5329bf739d4ec396e0d5acf2ffa

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2705869/
  
Delivery method
Distributed via web download

Comments