🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8600121c77bb725e24ffa58a657f3cbe752d9ed4299cc7e59127c9a7d6187eab. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DarkGate


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8600121c77bb725e24ffa58a657f3cbe752d9ed4299cc7e59127c9a7d6187eab
SHA3-384 hash: 3fde4b0302056b9bc704035489c70364c03b692b89cb273d8b6912480fef2131c080b3c1ac264e6ad788c3b28179adbd
SHA1 hash: 754d7afb2c3454d86ded95668c74c119c5ec4465
MD5 hash: 23561b5b561a171c3fa5094e2ff2f8f3
humanhash: item-juliet-maryland-seventeen
File name:Agreement-10-06.msi
Download: download sample
Signature DarkGate
Create hunting rule
File size:1'794'048 bytes
First seen:2023-10-09 14:23:19 UTC
Last seen:Never
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 49152:OpUPeZ5oqr5ygSbeBUJ+bOWbLiucsBUfFkA:OpDZaqNnoKUKOWa62
Threatray 6 similar samples on MalwareBazaar
TLSH T1B08512413A9AC53ACA9E1B3155BB87A26A25BC751B30D1CF7B607D2D4F323D3A539302
TrID 98.2% (.MSI) Microsoft Windows Installer (454500/1/170)
1.7% (.) Generic OLE2 / Multistream Compound (8000/1)
Reporter proxylife
Tags:DarkGate msi signed

Code Signing Certificate

Organisation:MK ZN s.r.o.
Issuer:SSL.com EV Code Signing Intermediate CA RSA R3
Algorithm:sha256WithRSAEncryption
Valid from:2023-09-28T15:14:10Z
Valid to:2024-09-27T15:14:10Z
Serial number: 59f296d0af649e0962d724248d9fdcdb
Intelligence: 8 malware samples on MalwareBazaar are signed with this code signing certificate
MalwareBazaar Blocklist:This certificate is on the MalwareBazaar code signing certificate blocklist (CSCB)
Cert Graveyard Blocklist:This certificate is on the Cert Graveyard blocklist
Thumbprint Algorithm:SHA256
Thumbprint: ce2aa31a714cc05f86d726a959f6655efc40777aa474fb6b9689154fdc918a44
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
156
Origin country :
GR GR
Vendor Threat Intelligence
Detection(s):
MiscreantPunch.SingleXOR.EXE.247.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.PWS.Banker1.30494.UNOFFICIAL
Create hunting rule

Verdict:
No Threat
Threat level:
  10/10
Confidence:
100%
Tags:
expand fingerprint lolbin packed shell32
Link:
https://www.filescan.io/uploads/65240d05f5e3ca1b0163a443/reports/6f220b82-0e29-4196-81f8-d02cea811594/overview
Verdict:
Malicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/8600121c77bb725e24ffa58a657f3cbe752d9ed4299cc7e59127c9a7d6187eab
Result
Threat name:
DarkGate
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/1322242
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to detect sleep reduction / modifications
Contains functionality to modify clipboard data
Found malware configuration
Yara detected DarkGate
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1322242 Sample: Agreement-10-06.msi Startdate: 09/10/2023 Architecture: WINDOWS Score: 76 43 wilsoncallert.com unknown unknown 2->43 47 Found malware configuration 2->47 49 Antivirus detection for URL or domain 2->49 51 Yara detected DarkGate 2->51 53 C2 URLs / IPs found in malware configuration 2->53 9 msiexec.exe 10 19 2->9         started        12 msiexec.exe 5 2->12         started        signatures3 process4 file5 39 C:\Windows\Installer\MSIC86F.tmp, PE32 9->39 dropped 41 C:\Windows\Installer\MSIAF07.tmp, PE32 9->41 dropped 14 msiexec.exe 5 9->14         started        process6 process7 16 KeyScramblerLogon.exe 2 14->16         started        20 expand.exe 11 14->20         started        22 icacls.exe 14->22         started        24 icacls.exe 14->24         started        file8 29 C:\Users\user\AppData\Local\...\Autoit3.exe, PE32 16->29 dropped 45 Contains functionality to detect sleep reduction / modifications 16->45 26 Autoit3.exe 16->26         started        31 C:\Users\user\...\keyscrambler.sys (copy), PE32 20->31 dropped 33 C:\Users\user\...\Uninstall.exe (copy), PE32 20->33 dropped 35 C:\Users\...\KeyScramblerLogon.exe (copy), PE32 20->35 dropped 37 7 other files (none is malicious) 20->37 dropped signatures9 process10 signatures11 55 Contains functionality to modify clipboard data 26->55
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8600121c77bb725e24ffa58a657f3cbe752d9ed4299cc7e59127c9a7d6187eab/
Threat name:
Win32.Trojan.Darkgate
Create hunting rule
Status:
Malicious
First seen:
2023-10-06 20:01:00 UTC
File Type:
Binary (Archive)
Extracted files:
139
AV detection:
7 of 23 (30.43%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qyabehdxxnzf4jh7uwfgk7z4xz2s3hwufgompzmre7e2pvqyp2vq._file
Verdict:
malicious
Similar samples:
202e0597e322c229fae286b650f7962a0b75ff43ba866848ba02312ad1558be3
DarkGate
4b67e4cea7a978c9a6a73d6217d2d55ee7d6ce3c2b5e6e6a4f59b5e5deb5a4e2
DarkGate
510af6dd87757c71cf084db4d924f5c7b6ff8cdfffc5084b98256b42078bcd5f
DarkGate
6750f31ef5e1fe74c1121b0ab1308f93e09505a63322b6ce16fe04099ce8993e
DarkGate
74729d4569691daf72e23849e91461471411f551639663e11e1091a48790611e
DarkGate
965f0fd494fedd05e104edf761a575459ad467081ec96464511cb8038f173846
DarkGate
Result
Malware family:
darkgate
Create hunting rule
Score:
  10/10
Tags:
family:darkgate botnet:a1111 discovery stealer
Link:
https://tria.ge/reports/231009-rqptcafe44/
Behaviour
Checks SCSI registry key(s)
Checks processor information in registry
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Uses Volume Shadow Copy service COM API
NSIS installer
Drops file in Windows directory
Blocklisted process makes network request
Enumerates connected drives
Executes dropped EXE
Loads dropped DLL
Modifies file permissions
DarkGate
Malware Config
C2 Extraction:
http://wilsoncallert.com
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8600121c77bb725e24ffa58a657f3cbe752d9ed4299cc7e59127c9a7d6187eab

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:maldoc_OLE_file_magic_number
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments