🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5b17e978c2ca2cf03e4ffff1e4609f2ec98738b1541fa41ba5b67f061e9e2af2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DarkGate


Vendor detections: 9


Intelligence 9 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5b17e978c2ca2cf03e4ffff1e4609f2ec98738b1541fa41ba5b67f061e9e2af2
SHA3-384 hash: 3f988be8bc7d2e78d04ca15133c35708c1b9bbca203db28953e3b40eec9c3c65f82b9bf4cc40f07e2b935bddb34df558
SHA1 hash: d0d59ce7c7a5845100e05d899c90267a7c97356a
MD5 hash: e0d96c0fdcd06ab07d66a11b57a0c6ce
humanhash: arkansas-florida-diet-delta
File name:darkgate.exe
Download: download sample
Signature DarkGate
Create hunting rule
File size:487'312 bytes
First seen:2023-07-26 15:06:36 UTC
Last seen:2023-08-03 13:07:19 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash fb5ae4b5aa4e7030af93ab337228f91b (3 x DarkGate)
ssdeep 12288:K4i0blotKmmt1seWzDcjEmXQmrZV0e2xvG6JimJP7RnBqnu3/3em:Kv2onmt1xWzDcAehrZ72xVJV7H+uv/
TLSH T1BCA45C36F5C0C477D1754E78CC5BE2D9942DBA606D2898077BE4DF0F8A792823A2B1C6
TrID 32.7% (.EXE) Win32 Executable Delphi generic (14182/79/4)
23.0% (.EXE) DOS Borland compiled Executable (generic) (10000/1/2)
15.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
10.3% (.EXE) Win32 Executable (generic) (4505/5/1)
4.7% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Reporter JAMESWT_WT
Tags:80-66-88-145 DarkGate exe laststage

Intelligence

File Origin
# of uploads :
2
# of downloads :
340
Origin country :
IT IT
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
darkgate.exe
Verdict:
Malicious activity
Analysis date:
2023-07-26 12:11:33 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/1e52b9b3-9104-4600-ac1f-f7a138c37c55

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/433992/
Detection(s):
SecuriteInfo.com.Variant.Jaik.136946.9578.12610.UNOFFICIAL
Create hunting rule

Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a file
Sending an HTTP POST request
Running batch commands
Creating a process with a hidden window
Launching a process
Gathering data
Verdict:
Malicious
Labled as:
Jaik.Generic
Link:
https://www.hybrid-analysis.com/sample/5b17e978c2ca2cf03e4ffff1e4609f2ec98738b1541fa41ba5b67f061e9e2af2
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/8549aac3-200c-46ee-beae-e1010e3b7640
Result
Threat name:
n/a
Detection:
malicious
Classification:
troj.evad
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/1280296
Signature
Found stalling execution ending in API Sleep call
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses known network protocols on non-standard ports
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5b17e978c2ca2cf03e4ffff1e4609f2ec98738b1541fa41ba5b67f061e9e2af2/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2023-07-26 15:06:47 UTC
File Type:
PE (Exe)
AV detection:
15 of 24 (62.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lml6s6gcziwpapsp77y6iye7f3eyoofrkqp2ig5fwz7qmhu6flza._file
Verdict:
malicious
Result
Malware family:
n/a
Score:
  10/10
Tags:
n/a
Link:
https://tria.ge/reports/230726-shavwsdh91/
Behaviour
Checks processor information in registry
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of NtCreateUserProcessOtherParentProcess
Unpacked files
SH256 hash:
5b17e978c2ca2cf03e4ffff1e4609f2ec98738b1541fa41ba5b67f061e9e2af2
MD5 hash:
e0d96c0fdcd06ab07d66a11b57a0c6ce
SHA1 hash:
d0d59ce7c7a5845100e05d899c90267a7c97356a
Link:
https://www.unpac.me/results/0ecf2803-ecb2-4b72-9d90-37d49941f853/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5b17e978c2ca2cf03e4ffff1e4609f2ec98738b1541fa41ba5b67f061e9e2af2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:command_and_control
Create hunting rule
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
Rule name:PUA_Crypto_Mining_CommandLine_Indicators_Oct21
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects command line parameters often used by crypto mining software
Reference:https://www.poolwatch.io/coin/monero

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/433992/

Comments