🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9cfdc3fe2a10fe2b514fc224c9c8740e1de039d90b9c17f85b64ff29d4a4ebb1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DarkGate


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9cfdc3fe2a10fe2b514fc224c9c8740e1de039d90b9c17f85b64ff29d4a4ebb1
SHA3-384 hash: 368758f11027e7af9d130e7a1d61e511b976fe9b8449cd5d7c8df8bc5ca23370c2828a840960a8c7971d53eca9fc8af9
SHA1 hash: e2043d24908028b3ff401e86bd13d52516dc7194
MD5 hash: 3bdccd0c78c8b1fc62164299cdf8c47e
humanhash: princess-march-ink-seventeen
File name:1.vbs
Download: download sample
Signature DarkGate
Create hunting rule
File size:2'298'018 bytes
First seen:2023-09-21 16:12:17 UTC
Last seen:2023-09-21 16:49:21 UTC
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 49152:YpUPIHOfHNhe86pb8eVx6zp/VGecycgnE5pPSI3a:YpZuPNhZcb8ejSp/VG1wIq
Threatray 107 similar samples on MalwareBazaar
TLSH T1A4B5231136D5C635CBAE133782AB83B910357DA01B34D1CFBBA9BD6C6B716C2A935312
TrID 98.2% (.MSI) Microsoft Windows Installer (454500/1/170)
1.7% (.) Generic OLE2 / Multistream Compound (8000/1)
Reporter k3dg3___
Tags:94-228-169-123 DarkGate msi ta577

Intelligence

File Origin
# of uploads :
2
# of downloads :
149
Origin country :
US US
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/450453/
Detection(s):
MiscreantPunch.SingleXOR.EXE.223.UNOFFICIAL
Create hunting rule

Verdict:
No Threat
Threat level:
  10/10
Confidence:
100%
Tags:
expand fingerprint lolbin masquerade packed shell32
Link:
https://www.filescan.io/uploads/650c6b8e33582f234efeaa57/reports/dc43ea56-d155-44d5-8136-81b03aafb3f2/overview
Verdict:
Suspicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/9cfdc3fe2a10fe2b514fc224c9c8740e1de039d90b9c17f85b64ff29d4a4ebb1
Result
Threat name:
DarkGate
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/1312477
Signature
C2 URLs / IPs found in malware configuration
Contains functionality to detect sleep reduction / modifications
Contains functionality to modify clipboard data
Found malware configuration
Yara detected DarkGate
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1312477 Sample: 1.vbs.msi Startdate: 21/09/2023 Architecture: WINDOWS Score: 68 43 94.228.169.143 SSERVICE-ASRU Russian Federation 2->43 47 Found malware configuration 2->47 49 Yara detected DarkGate 2->49 51 C2 URLs / IPs found in malware configuration 2->51 9 msiexec.exe 8 19 2->9         started        12 msiexec.exe 5 2->12         started        signatures3 process4 file5 39 C:\Windows\Installer\MSIC794.tmp, PE32 9->39 dropped 41 C:\Windows\Installer\MSIB2FE.tmp, PE32 9->41 dropped 14 msiexec.exe 5 9->14         started        process6 process7 16 KeyScramblerLogon.exe 2 14->16         started        20 expand.exe 20 14->20         started        22 icacls.exe 14->22         started        24 icacls.exe 14->24         started        file8 29 C:\Users\user\AppData\Local\...\Autoit3.exe, PE32 16->29 dropped 45 Contains functionality to detect sleep reduction / modifications 16->45 26 Autoit3.exe 16->26         started        31 C:\Users\user\...\keyscrambler.sys (copy), PE32 20->31 dropped 33 C:\Users\user\...\Uninstall.exe (copy), PE32 20->33 dropped 35 C:\Users\user\...\QFXUpdateService.exe (copy), PE32 20->35 dropped 37 13 other files (none is malicious) 20->37 dropped signatures9 process10 signatures11 53 Contains functionality to modify clipboard data 26->53
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9cfdc3fe2a10fe2b514fc224c9c8740e1de039d90b9c17f85b64ff29d4a4ebb1/
Threat name:
Win32.Trojan.Zusy
Create hunting rule
Status:
Malicious
First seen:
2023-09-21 16:13:05 UTC
File Type:
Binary (Archive)
Extracted files:
125
AV detection:
10 of 38 (26.32%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tt64h7rkcd7cwukpyismtsdubyo6aoozboobp6c3mt7stvfe5oyq._file
Verdict:
malicious
Similar samples:
05ee959d42eb453c1c4bbcd742e22670caf4ac2c941b0071ee587a4535f1b3b6
DarkGate
0c43398c9b643823f879aaaa2e3cc9f4511cb1e45687bf673812ac55f527ff12
DarkGate
510af6dd87757c71cf084db4d924f5c7b6ff8cdfffc5084b98256b42078bcd5f
DarkGate
711b9ebcf9aca14620ede45cff8bdf14f7a7e6943c9917fb9cfc91f3c272c7c2
DarkGate
8ce6620ef7346fbb807b72293ce965b05b5cd37036a9d3a17c834b79e15910f4
DarkGate
a9ee4f3dcb9ae9ef57d9677a899d5f1c011dcb17275e95baf87a869f4f3dadeb
DarkGate
be69add1213202bc7a038a2cfb2cf8ece07eeaaf163c2e17873c54d303e3abfa
DarkGate
+ 97 additional samples on MalwareBazaar
Result
Malware family:
darkgate
Create hunting rule
Score:
  10/10
Tags:
family:darkgate discovery stealer
Link:
https://tria.ge/reports/230921-tn221ahc3z/
Behaviour
Checks SCSI registry key(s)
Checks processor information in registry
Enumerates system info in registry
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Uses Volume Shadow Copy service COM API
NSIS installer
Drops file in Windows directory
Enumerates connected drives
Executes dropped EXE
Loads dropped DLL
Modifies file permissions
DarkGate
Malware Config
C2 Extraction:
http://94.228.169.143
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.15
Link:
https://yomi.yoroi.company/submissions/9cfdc3fe2a10fe2b514fc224c9c8740e1de039d90b9c17f85b64ff29d4a4ebb1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:maldoc_OLE_file_magic_number
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Link
https://tria.ge/230921-thkkrshc2t/behavioral2
  
Delivery method
Distributed via e-mail link
Cape
Cape
https://www.capesandbox.com/analysis/450453/

Comments