MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 92ffa8c1f772ff5487bb29f1539148bd6893ab4abf1de7ed603f84cbc39deddb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DarkGate


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 92ffa8c1f772ff5487bb29f1539148bd6893ab4abf1de7ed603f84cbc39deddb
SHA3-384 hash: 2dbcb4289ef7406527495af7e396e3bbe8007237578164e5ca39af271051cbb2763da3f38d6ceb566fdde9a76e75f5f0
SHA1 hash: ee06b5c4da2721323cfef688e48cf917c9f0edce
MD5 hash: 37593bb56df9b3ad6c9c8b777a7265ad
humanhash: colorado-stairway-potato-leopard
File name:31ae2a2367b4fc.msi
Download: download sample
Signature DarkGate
Create hunting rule
File size:9'007'104 bytes
First seen:2023-11-07 15:42:32 UTC
Last seen:2023-11-07 17:43:04 UTC
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 196608:IeS5hV9/S6WXbfXlTrn7HZ5AQX3AveLukj1w9SyqunTiE7vS+:IdhVs6WXjX9HZ5AQX32WDjyqumI
TLSH T1919633607299C636D28F133A825BB6612B607E101B70D1C727E47A2C15307F7AF76BA7
TrID 98.2% (.MSI) Microsoft Windows Installer (454500/1/170)
1.7% (.) Generic OLE2 / Multistream Compound (8000/1)
Reporter malwarelabnet
Tags:DarkGate msi

Intelligence

File Origin
# of uploads :
2
# of downloads :
210
Origin country :
CA CA
Vendor Threat Intelligence
Detection(s):
TwinWave.EvilMSI.PkillImAfraidOfUnregisteredMSIinstallers.20231026.UNOFFICIAL
Create hunting rule

Verdict:
No Threat
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug expand fingerprint hacktool installer lolbin packed shell32
Link:
https://www.filescan.io/uploads/654a5b07993fbf888b6865db/reports/df81d71c-8c97-493f-a232-a0c1ca5f15c8/overview
Verdict:
Suspicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/92ffa8c1f772ff5487bb29f1539148bd6893ab4abf1de7ed603f84cbc39deddb
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/92ffa8c1f772ff5487bb29f1539148bd6893ab4abf1de7ed603f84cbc39deddb
Result
Threat name:
DarkGate, MailPassView
Create hunting rule
Detection:
malicious
Classification:
rans.troj.spyw.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/1338331
Signature
C2 URLs / IPs found in malware configuration
Contains functionality to modify clipboard data
Contains functionality to register a low level keyboard hook
Deletes shadow drive data (may be related to ransomware)
Found malware configuration
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected DarkGate
Yara detected MailPassView
Yara detected WebBrowserPassView password recovery tool
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1338331 Sample: 31ae2a2367b4fc.msi Startdate: 07/11/2023 Architecture: WINDOWS Score: 96 42 Found malware configuration 2->42 44 Yara detected DarkGate 2->44 46 Yara detected MailPassView 2->46 48 3 other signatures 2->48 8 msiexec.exe 10 17 2->8         started        11 msiexec.exe 5 2->11         started        process3 file4 28 C:\Windows\Installer\MSI69BC.tmp, PE32 8->28 dropped 13 msiexec.exe 5 8->13         started        process5 process6 15 windbg.exe 3 13->15         started        19 expand.exe 11 13->19         started        21 cmd.exe 13->21         started        23 2 other processes 13->23 file7 30 C:\tmpa\Autoit3.exe, PE32 15->30 dropped 36 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 15->36 38 Contains functionality to register a low level keyboard hook 15->38 40 Contains functionality to modify clipboard data 15->40 25 Autoit3.exe 15->25         started        32 C:\...\bf0b51e224ae8349b0fd4f8d36ece61a.tmp, PE32 19->32 dropped 34 C:\...\b374357290e2344da3382fd4c3d33d05.tmp, PE32 19->34 dropped signatures8 process9 signatures10 50 Deletes shadow drive data (may be related to ransomware) 25->50 52 Contains functionality to modify clipboard data 25->52
Score:
79%
Verdict:
Malware
File Type:
MSI
Link:
https://malprob.io/report/92ffa8c1f772ff5487bb29f1539148bd6893ab4abf1de7ed603f84cbc39deddb
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/92ffa8c1f772ff5487bb29f1539148bd6893ab4abf1de7ed603f84cbc39deddb/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=sl72rqpxol7vjb53fhyvhekixvujhk2kx4o6p3lah6cmxq455xnq._file
Verdict:
malicious
Result
Malware family:
darkgate
Create hunting rule
Score:
  10/10
Tags:
family:darkgate botnet:user_871236672 discovery stealer
Link:
https://tria.ge/reports/231107-s5w2msbb51/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Uses Volume Shadow Copy service COM API
Checks SCSI registry key(s)
Checks processor information in registry
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Drops file in Windows directory
Enumerates connected drives
Executes dropped EXE
Loads dropped DLL
Modifies file permissions
DarkGate
Malware Config
C2 Extraction:
http://8sjimonstersboonkonline.com
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
DarkGate
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/92ffa8c1f772ff5487bb29f1539148bd6893ab4abf1de7ed603f84cbc39deddb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:maldoc_OLE_file_magic_number
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments