🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 634dd946969fd0ea89693faa9943907a7d539c722dc63a5dbd4b23a2bee6daae. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DarkGate


Vendor detections: 13


Intelligence 13 IOCs YARA 17 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 634dd946969fd0ea89693faa9943907a7d539c722dc63a5dbd4b23a2bee6daae
SHA3-384 hash: 7d08ea671ae0a90801887785b712ef6d8da8bc7e1d700f26c6a7ec459b0da49da6d1296bf60732166ca9ef4cda84fb27
SHA1 hash: 7e7edfd66d742e4dad4bea84aceb2a4ece7c817d
MD5 hash: 9b979d3d3f37bcb0525fe001b19be432
humanhash: mango-finch-four-hawaii
File name:634dd946969fd0ea89693faa9943907a7d539c722dc63a5dbd4b23a2bee6daae
Download: download sample
Signature DarkGate
Create hunting rule
File size:3'796'818 bytes
First seen:2025-01-17 10:46:32 UTC
Last seen:2025-01-17 10:53:37 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 40ab50289f7ef5fae60801f88d4541fc (81 x ValleyRAT, 59 x Gh0stRAT, 42 x OffLoader)
ssdeep 49152:XwREDDMNDZqY8tmwzAdvzL+OqQ3BkPr8Yw4z0g3QT5W9ky+sdHeMxWrP+beY7UY2:XwREgZqPmwMFL1qKBExDzJQm+sdMwZgN
TLSH T10406F112E1EFD87ED9DE1B360163918430FB3914A0256D079BFCF9D8CE24A366C6E15A
TrID 39.3% (.EXE) Inno Setup installer (107240/4/30)
21.1% (.CPL) Windows Control Panel Item (generic) (57583/11/19)
15.7% (.EXE) InstallShield setup (43053/19/16)
15.2% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9)
3.8% (.EXE) Win64 Executable (generic) (10522/11/4)
Magika pebin
File icon (PE):PE icon
dhash icon 5050d270cccc82ae (113 x Adware.Generic, 85 x OffLoader, 48 x ValleyRAT)
Reporter JAMESWT_WT
Tags:185-196-10-22 DarkGate exe greenindustry-pl

Intelligence

File Origin
# of uploads :
2
# of downloads :
505
Origin country :
IT IT
Vendor Threat Intelligence
Malware family:
asyncrat
Create hunting rule
ID:
1
File name:
634dd946969fd0ea89693faa9943907a7d539c722dc63a5dbd4b23a2bee6daae
Verdict:
Malicious activity
Analysis date:
2025-01-17 11:06:46 UTC
Tags:
delphi inno installer autoit rat asyncrat remote stealer netreactor purehvnc
Link:
https://app.any.run/tasks/9fee9cc7-f31a-4982-a5d1-61a95ac218f4

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.DownLoad4.16298-2.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=678a353b4487910100dfc1c2
Tags:
autoit crysan emotet
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Creating a window
Creating a process from a recently created file
Сreating synchronization primitives
Searching for synchronization primitives
Creating a process with a hidden window
Creating a file
Launching a process
Using the Windows Management Instrumentation requests
Searching for the window
Connecting to a non-recommended domain
Connection attempt
Sending a custom TCP request
Setting a single autorun event
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context embarcadero_delphi fingerprint installer overlay packed packer_detected
Link:
https://www.filescan.io/uploads/678a3535ba38081b4a1a5282/reports/5ff078b5-ea8e-45c6-b88d-3fa5ffcd3268/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/634dd946969fd0ea89693faa9943907a7d539c722dc63a5dbd4b23a2bee6daae
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/c230e5e9-e68f-4fb9-a69e-67c6e1930939
Result
Threat name:
n/a
Detection:
malicious
Classification:
spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1593605
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
AI detected suspicious sample
Antivirus / Scanner detection for submitted sample
Found many strings related to Crypto-Wallets (likely being stolen)
Multi AV Scanner detection for submitted file
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)
Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments
Suricata IDS alerts for network traffic
Tries to harvest and steal Bitcoin Wallet information
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1593605 Sample: JiH0aUfOU6.exe Startdate: 17/01/2025 Architecture: WINDOWS Score: 100 44 Suricata IDS alerts for network traffic 2->44 46 Antivirus / Scanner detection for submitted sample 2->46 48 Multi AV Scanner detection for submitted file 2->48 50 4 other signatures 2->50 8 JiH0aUfOU6.exe 2 2->8         started        11 AutoIt3.exe 2->11         started        13 AutoIt3.exe 2->13         started        process3 file4 32 C:\Users\user\AppData\...\JiH0aUfOU6.tmp, PE32 8->32 dropped 15 JiH0aUfOU6.tmp 3 5 8->15         started        18 RegAsm.exe 3 11->18         started        20 RegAsm.exe 11->20         started        22 RegAsm.exe 2 13->22         started        process5 file6 36 C:\Users\user\AppData\Local\...\Autoit3.exe, PE32 15->36 dropped 38 C:\Users\user\AppData\Local\...\script.a3x, zlib 15->38 dropped 40 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 15->40 dropped 24 Autoit3.exe 1 4 15->24         started        process7 file8 34 C:\kchhcfb\AutoIt3.exe, PE32 24->34 dropped 52 Found many strings related to Crypto-Wallets (likely being stolen) 24->52 28 RegAsm.exe 1 2 24->28         started        signatures9 process10 dnsIp11 42 185.196.10.22, 49869, 49870, 56001 SIMPLECARRIERCH Switzerland 28->42 54 Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines) 28->54 56 Found many strings related to Crypto-Wallets (likely being stolen) 28->56 58 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 28->58 60 3 other signatures 28->60 signatures12
Score:
81%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/634dd946969fd0ea89693faa9943907a7d539c722dc63a5dbd4b23a2bee6daae
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/634dd946969fd0ea89693faa9943907a7d539c722dc63a5dbd4b23a2bee6daae/
Threat name:
Win32.Backdoor.Redcap
Create hunting rule
Status:
Malicious
First seen:
2024-08-26 17:40:56 UTC
File Type:
PE (Exe)
AV detection:
15 of 38 (39.47%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mng5sruwt7iovcljh6vjsq4qpj6vhhdsfxdduxn5jmr2fpxg3kxa._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery execution persistence spyware stealer
Link:
https://tria.ge/reports/250117-mvjqnstngt/
Behaviour
Checks processor information in registry
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Command and Scripting Interpreter: AutoIT
Suspicious use of SetThreadContext
Adds Run key to start application
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/c6d7062c-c869-4aab-8981-4a144f86fcc5
Unpacked files
SH256 hash:
ef268eeea4b63a80b3e9e3047fd1e44bfa18f88ab54a4d4b42d829f5c1d3a1ea
MD5 hash:
7fbcaeb4edc8c4bc50a3efb47b55e570
SHA1 hash:
7626e6a3ba7d2f06af08076c87efa945cd13ddce
Detections:
win_darkgate_w1
Create hunting rule
Link:
https://www.unpac.me/results/0d90d78e-1cac-4747-af28-23bf80a48fc8/
SH256 hash:
a6202551e01b10d469c12929931f3e192126b05fec5d5f70025bbeec36db8e15
MD5 hash:
77a513cf32110553da4e6f2fa14a70da
SHA1 hash:
aa193427dc82811a0e319e7ccbbffe8ab6f1ba0f
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/0d90d78e-1cac-4747-af28-23bf80a48fc8/
SH256 hash:
2b3900c9f79a22a8bd5884defec64e1b9aa99cfb0c6517aa96be6af55d34f2de
MD5 hash:
1897641bfffc753eed2278b2e0a12120
SHA1 hash:
9c2550c0bac66adee22ffcba8bc1d6e5189e9007
Detections:
AutoIT_Compiled
Create hunting rule
Link:
https://www.unpac.me/results/0d90d78e-1cac-4747-af28-23bf80a48fc8/
SH256 hash:
2e54b07a383839eddbeeede6f44294b176cf06bf9ef8f8dd3209f69b4ceb1440
MD5 hash:
7d8b7f5044ee6662aaaf17c1c6c2cacf
SHA1 hash:
7b44ede814a66d3c0074519c5ed5af6b8347b0cc
Link:
https://www.unpac.me/results/0d90d78e-1cac-4747-af28-23bf80a48fc8/
SH256 hash:
1b9dd67b77f89b93163167c66bd9f74dd9751f45429daae268a1f9bc3ed2cebe
MD5 hash:
fbc0a57f3a82a40fae58c46644a12f68
SHA1 hash:
11a77cd7f26dc0e28caa119d3c6b49f3e74b3e0e
Link:
https://www.unpac.me/results/0d90d78e-1cac-4747-af28-23bf80a48fc8/
SH256 hash:
634dd946969fd0ea89693faa9943907a7d539c722dc63a5dbd4b23a2bee6daae
MD5 hash:
9b979d3d3f37bcb0525fe001b19be432
SHA1 hash:
7e7edfd66d742e4dad4bea84aceb2a4ece7c817d
Link:
https://www.unpac.me/results/0d90d78e-1cac-4747-af28-23bf80a48fc8/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:DarkGate
Create hunting rule
Author:enzok
Description:DarkGate Payload
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Detect_Nimplant_PE
Create hunting rule
Author:daniyyell
Description:Detects malicious nimplant variant PE malware.
Rule name:malware_shellcode_hash
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect shellcode api hash value
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques
Rule name:Windows_Generic_Threat_642df623
Create hunting rule
Author:Elastic Security
Rule name:Windows_Trojan_DarkGate_07ef6f14
Create hunting rule
Author:Elastic Security
Rule name:Win_DarkGate
Create hunting rule
Author:0xToxin
Description:DarkGate Strings Decryption Routine
Rule name:win_darkgate_w1
Create hunting rule
Author:enzok
Description:DarkGate Payload

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
Reviews
IDCapabilitiesEvidence
AUTH_APIManipulates User Authorizationadvapi32.dll::AllocateAndInitializeSid
advapi32.dll::ConvertSidToStringSidW
advapi32.dll::ConvertStringSecurityDescriptorToSecurityDescriptorW
advapi32.dll::EqualSid
advapi32.dll::FreeSid
SECURITY_BASE_APIUses Security Base APIadvapi32.dll::AdjustTokenPrivileges
advapi32.dll::GetTokenInformation
WIN32_PROCESS_APICan Create Process and Threadskernel32.dll::CreateProcessW
advapi32.dll::OpenProcessToken
advapi32.dll::OpenThreadToken
kernel32.dll::CloseHandle
kernel32.dll::CreateThread
WIN_BASE_APIUses Win Base APIkernel32.dll::LoadLibraryA
kernel32.dll::LoadLibraryExW
kernel32.dll::LoadLibraryW
kernel32.dll::GetDriveTypeW
kernel32.dll::GetVolumeInformationW
kernel32.dll::GetSystemInfo
WIN_BASE_IO_APICan Create Fileskernel32.dll::CreateDirectoryW
kernel32.dll::CreateFileW
kernel32.dll::DeleteFileW
kernel32.dll::GetWindowsDirectoryW
kernel32.dll::GetSystemDirectoryW
kernel32.dll::GetFileAttributesW
WIN_BASE_USER_APIRetrieves Account Informationadvapi32.dll::LookupPrivilegeValueW
WIN_REG_APICan Manipulate Windows Registryadvapi32.dll::RegOpenKeyExW
advapi32.dll::RegQueryValueExW
WIN_USER_APIPerforms GUI Actionsuser32.dll::PeekMessageW
user32.dll::CreateWindowExW

Comments