🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 711b9ebcf9aca14620ede45cff8bdf14f7a7e6943c9917fb9cfc91f3c272c7c2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DarkGate


Vendor detections: 7


Intelligence 7 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 711b9ebcf9aca14620ede45cff8bdf14f7a7e6943c9917fb9cfc91f3c272c7c2
SHA3-384 hash: ea7e3716d6693dd68984b0f35a6f9183a59f576223fb081fb1beb1ed0b570b3190c2d92695b894c509ac464fbdd69f6c
SHA1 hash: 9e00c572cef6b6704a289496faebe9d5d7ff18c7
MD5 hash: cdfe802f02d49696d04f13b9dcddcb70
humanhash: wyoming-skylark-johnny-quiet
File name:open_ver_2.2.6.msi
Download: download sample
Signature DarkGate
Create hunting rule
File size:2'334'720 bytes
First seen:2023-09-14 12:37:03 UTC
Last seen:Never
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 49152:tpUPhy14oGZE/r3LUqMWYLbsYCF6q023sKylydcDMaXWdOq:tpgyEZE/zYHWUq0rK+yWDM9Oq
Threatray 100 similar samples on MalwareBazaar
TLSH T1DDB523523A84C63AD78B073645BBCB6A26293D711B31D0CF7655396C9B32BD2E934323
TrID 98.2% (.MSI) Microsoft Windows Installer (454500/1/170)
1.7% (.) Generic OLE2 / Multistream Compound (8000/1)
Reporter JAMESWT_WT
Tags:178-236-247-102 DarkGate msi PFO GROUP LLC

Intelligence

File Origin
# of uploads :
1
# of downloads :
166
Origin country :
IT IT
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/448628/
Detection(s):
MiscreantPunch.SingleXOR.EXE.241.UNOFFICIAL
Create hunting rule

Verdict:
No Threat
Threat level:
  2/10
Confidence:
100%
Tags:
expand fingerprint lolbin masquerade packed shell32
Link:
https://www.filescan.io/uploads/6502feaada7b76f50a24fe7a/reports/e1cd467b-8822-433b-b13a-a4efabdadf67/overview
Verdict:
Suspicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/711b9ebcf9aca14620ede45cff8bdf14f7a7e6943c9917fb9cfc91f3c272c7c2
Result
Threat name:
DarkGate
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/1307826
Signature
Connects to many ports of the same IP (likely port scanning)
Contains functionality to detect sleep reduction / modifications
Contains functionality to modify clipboard data
Creates a thread in another existing process (thread injection)
Opens the same file many times (likely Sandbox evasion)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected DarkGate
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1307826 Sample: open_ver_2.2.6.msi Startdate: 14/09/2023 Architecture: WINDOWS Score: 72 71 Yara detected DarkGate 2->71 73 Connects to many ports of the same IP (likely port scanning) 2->73 75 Contains functionality to modify clipboard data 2->75 10 msiexec.exe 8 19 2->10         started        13 TabTip32.exe 2->13         started        15 Autoit3.exe 2->15         started        17 2 other processes 2->17 process3 file4 53 C:\Windows\Installer\MSIC027.tmp, PE32 10->53 dropped 55 C:\Windows\Installer\MSIB6D2.tmp, PE32 10->55 dropped 19 msiexec.exe 5 10->19         started        21 TabTip32.exe 13->21         started        24 TabTip32.exe 13->24         started        26 cmd.exe 1 15->26         started        process5 signatures6 28 KeyScramblerLogon.exe 2 19->28         started        32 expand.exe 23 19->32         started        34 icacls.exe 19->34         started        36 icacls.exe 19->36         started        77 Opens the same file many times (likely Sandbox evasion) 21->77 process7 file8 59 C:\Users\user\AppData\Local\...\Autoit3.exe, PE32 28->59 dropped 87 Contains functionality to detect sleep reduction / modifications 28->87 38 Autoit3.exe 8 28->38         started        61 C:\Users\user\...\keyscrambler.sys (copy), PE32 32->61 dropped 63 C:\Users\user\...\Uninstall.exe (copy), PE32 32->63 dropped 65 C:\Users\user\...\QFXUpdateService.exe (copy), PE32 32->65 dropped 67 13 other files (none is malicious) 32->67 dropped signatures9 process10 file11 51 C:\temp\AutoIt3.exe, PE32 38->51 dropped 79 Contains functionality to modify clipboard data 38->79 42 cmd.exe 6 38->42         started        signatures12 process13 dnsIp14 69 178.236.247.102, 27850, 9999 PRANET-ASRU Russian Federation 42->69 57 C:\ProgramData\kbhabbc\Autoit3.exe, PE32 42->57 dropped 81 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 42->81 83 Opens the same file many times (likely Sandbox evasion) 42->83 85 Creates a thread in another existing process (thread injection) 42->85 47 TabTip32.exe 42->47         started        49 TabTip32.exe 42->49         started        file15 signatures16 process17
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/711b9ebcf9aca14620ede45cff8bdf14f7a7e6943c9917fb9cfc91f3c272c7c2/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=oenz5phzvsqumihn4rop7c67ct32pzuuhsmrp6447si7hqtsy7ba._file
Verdict:
malicious
Similar samples:
05ee959d42eb453c1c4bbcd742e22670caf4ac2c941b0071ee587a4535f1b3b6
DarkGate
0c43398c9b643823f879aaaa2e3cc9f4511cb1e45687bf673812ac55f527ff12
DarkGate
0e01bad874c61d09d09ce06f76f5e46f6648a1fc943644874c8e1a53a93af9a7
DarkGate
510af6dd87757c71cf084db4d924f5c7b6ff8cdfffc5084b98256b42078bcd5f
DarkGate
5b608a6729343cf8b6752d5bb201f906920fcb472f5949e04173b907f65ceff1
DarkGate
5be83d13f20b4a044a8c8281d13723a808555cdd73a7ddcec37422a4e44fbd4e
DarkGate
6b5c5163edae524314762a092cec99048c13d4ead9d990e901d17dade365bbeb
DarkGate
6e068b9dcd8df03fd6456faeb4293c036b91a130a18f86a945c8964a576c1c70
DarkGate
a8eed563dfc4c42a1f4aae628df948566bceda3aa3297eb61647156a52737e6f
DarkGate
be69add1213202bc7a038a2cfb2cf8ece07eeaaf163c2e17873c54d303e3abfa
DarkGate
+ 90 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
discovery
Link:
https://tria.ge/reports/230914-pt2k7sef28/
Behaviour
Checks SCSI registry key(s)
Checks processor information in registry
Enumerates system info in registry
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Uses Volume Shadow Copy service COM API
NSIS installer
Enumerates physical storage devices
Drops file in Windows directory
Suspicious use of SetThreadContext
Enumerates connected drives
Drops startup file
Executes dropped EXE
Loads dropped DLL
Modifies file permissions
Blocklisted process makes network request
Suspicious use of NtCreateUserProcessOtherParentProcess
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/711b9ebcf9ac/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.63
Link:
https://yomi.yoroi.company/submissions/711b9ebcf9aca14620ede45cff8bdf14f7a7e6943c9917fb9cfc91f3c272c7c2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:maldoc_OLE_file_magic_number
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DarkGate

Microsoft Software Installer (MSI) msi 711b9ebcf9aca14620ede45cff8bdf14f7a7e6943c9917fb9cfc91f3c272c7c2

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2711691/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/448628/

Comments