MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e
SHA3-384 hash:	0f131056ac741e10f31f13aaa2bfd2396e93aa6c628bf792f129c816193e5c4020f151a10eb4b9486738cbcb2835fac6
SHA1 hash:	8903948573b7520dcb5ee06c382cbf024e21c8a0
MD5 hash:	2a38b751e44881286761a7eb61539726
humanhash:	asparagus-yankee-tennis-xray
File name:	DarkGate_Loader.exe
Download:	download sample
Signature	DarkGate Alert Create hunting rule
File size:	25'812'992 bytes
First seen:	2024-11-28 08:10:48 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	650f7bbbc95f7c35c7ab0caa36f95459 (1 x DarkGate)
ssdeep	393216:T7sOjzX/9qeXqn7eBiWDMW8eInlbu24WIci6zAILp50Un7RcGeWrKMN:TdzX/9rXqw9y1nA2rIcuGp5B7ddf
TLSH	T1A94733C3011A73B3E286B63D9E49ACF50555386E9F877E724F79E18B223E1D1898B047
TrID	81.7% (.EXE) UPX compressed Win32 Executable (27066/9/6) 6.1% (.EXE) OS/2 Executable (generic) (2029/13) 6.0% (.EXE) Generic Win/DOS Executable (2002/3) 6.0% (.EXE) DOS Executable Generic (2000/1) 0.0% (.VXD) VXD Driver (29/21)
Magika	pebin
File icon (PE):
dhash icon	dcfcfcf2dac17818 (2 x DarkGate)
Reporter	lontze7
Tags:	DarkGate exe

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

556

Origin country :

FR

Vendor Threat Intelligence

ANY.RUN

Malware family:

n/a

ID:

1

File name:

DarkGate_Loader.exe

Verdict:

No threats detected

Analysis date:

2024-11-28 08:26:19 UTC

Tags:

upx

Link:

https://app.any.run/tasks/aea5a491-b47c-496d-831c-13a73e326382

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

ClamAV Detected

Detection(s):

SecuriteInfo.com.Win32.HLLW.Autoruner1.14959.20792.6108.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Clean

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=674826e9d0583382434ba55f

Tags:

malware

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Creating a window

Searching for synchronization primitives

Searching for the window

Launching a process

Hybrid Analysis PSWTool.WebBrowserPassView

Verdict:

Suspicious

Labled as:

PSWTool.WebBrowserPassView

Link:

https://www.hybrid-analysis.com/sample/809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

troj.evad

Score:

76 / 100

Link:

https://www.joesandbox.com/analysis/1564383

Signature

Found direct / indirect Syscall (likely to bypass EDR)

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Costura Assembly Loader

Yara detected Telegram RAT

Yara detected WebBrowserPassView password recovery tool

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

97%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/809a49e7d55ccdfb06509fd21a907f12be24c7d43ae6941d35c1a54ba58e549e

CERT.PL MWDB

Gathering data

ReversingLabs TitaniumCloud Win64.Trojan.Malgent

Threat name:

Win64.Trojan.Malgent

Alert

Create hunting rule

Status:

Malicious

First seen:

2024-11-28 09:10:00 UTC

File Type:

PE+ (Exe)

Extracted files:

625

AV detection:

11 of 38 (28.95%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=qcnetz6vltg7wbsqt7jbved7ck7cjr6uhltjihjvygsuxjmokspa._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  9/10

Tags:

upx

Link:

https://tria.ge/reports/241128-j29zna1ney/

Behaviour

Checks processor information in registry

Modifies Control Panel

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

UPX packed file

Detected Nirsoft tools

NirSoft MailPassView

NirSoft WebBrowserPassView

Threat.Zone Suspicious

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/712b6401-2597-4d63-95db-940653fd082b

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.