🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9e4f036dd6fbb45ce414cb5d040b3255b5ccc9ecacbfaf022b631545f9a19a02. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DarkGate


Vendor detections: 10


Intelligence 10 IOCs YARA 8 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9e4f036dd6fbb45ce414cb5d040b3255b5ccc9ecacbfaf022b631545f9a19a02
SHA3-384 hash: 2043c38e0f8dff38b40def1a97de1e20e20cf7a8eba88fce142aab6e87c19d439a17831453b6252e46671ce37aa3592a
SHA1 hash: 431157eaf15244e5d8cc167511b4611f4dfae85c
MD5 hash: 8c3ef2eba970f543f0ebe6dced908402
humanhash: lion-autumn-twelve-table
File name:Whatsapp-GUI.exe
Download: download sample
Signature DarkGate
Create hunting rule
File size:285'584 bytes
First seen:2024-12-14 20:37:13 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'234 x AgentTesla, 20'488 x Formbook, 12'372 x SnakeKeylogger)
ssdeep 3072:FUbtVKuFEC34/8yBV+VKuFJC34GtmANWJ/j3:FUb/KVKq8NKmKntZWJT
Threatray 1'215 similar samples on MalwareBazaar
TLSH T167546795A720D91EC8A7473ACC73EA522F63FC185555932E02987625BD313A30ADB3CF
TrID 69.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.0% (.EXE) Win64 Executable (generic) (10522/11/4)
6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.2% (.EXE) Win32 Executable (generic) (4504/4/1)
1.9% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Magika pebin
File icon (PE):PE icon
dhash icon 71cc8eaaa2c6ea32 (1 x DarkGate)
Reporter smica83
Tags:154-216-16-83 DarkGate exe signed Whatsapp Whatsapp-GUI XUAN THANH CEMENT JOINT STOCK COMPANY

Code Signing Certificate

Organisation:XUAN THANH CEMENT JOINT STOCK COMPANY
Issuer:GlobalSign GCC R45 EV CodeSigning CA 2020
Algorithm:sha256WithRSAEncryption
Valid from:2024-11-15T02:33:14Z
Valid to:2025-11-16T02:33:14Z
Serial number: 34f3e42f122c45100811225d
MalwareBazaar Blocklist:This certificate is on the MalwareBazaar code signing certificate blocklist (CSCB)
Cert Graveyard Blocklist:This certificate is on the Cert Graveyard blocklist
Thumbprint Algorithm:SHA256
Thumbprint: 710f4af0801ad3eaef2b61d2968a7a3cf88529b5809c196e53ea4d3f859aee5f
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
586
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Whatsapp-GUI.exe
Verdict:
Malicious activity
Analysis date:
2024-12-14 20:39:40 UTC
Tags:
arch-exec autoit darkgate
Link:
https://app.any.run/tasks/df97abf4-0c04-41b7-9bdc-a0e3e0d60c24

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
Score:
94.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=675ded658fb73f13afc7499c
Tags:
autoit emotet
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
DNS request
Connection attempt
Sending a custom TCP request
Creating a file
Moving a recently created file
Creating a process from a recently created file
Creating a process with a hidden window
Creating a file in the %AppData% directory
Running batch commands
Launching a process
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
fingerprint keylogger
Link:
https://www.filescan.io/uploads/675decaa20320a764c015c54/reports/605555bc-8ce4-423e-878a-10acf55cd84c/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/9e4f036dd6fbb45ce414cb5d040b3255b5ccc9ecacbfaf022b631545f9a19a02
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/7f96e8a3-61ea-4299-96c7-b1ef58785402
Result
Threat name:
DarkGate, MailPassView
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
69 / 100
Link:
https://www.joesandbox.com/analysis/1575235
Signature
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Contains functionality to detect sleep reduction / modifications
Contains functionality to inject code into remote processes
Contains functionality to inject threads in other processes
Creates autostart registry keys with suspicious names
Found malware configuration
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected DarkGate
Yara detected MailPassView
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1575235 Sample: Whatsapp-GUI.exe Startdate: 14/12/2024 Architecture: WINDOWS Score: 69 35 www.dropbox.com 2->35 37 www-env.dropbox-dns.com 2->37 39 2 other IPs or domains 2->39 47 Found malware configuration 2->47 49 Yara detected DarkGate 2->49 51 Yara detected MailPassView 2->51 53 3 other signatures 2->53 9 Whatsapp-GUI.exe 15 8 2->9         started        13 Autoit3.exe 1 2->13         started        16 Autoit3.exe 2->16         started        signatures3 process4 dnsIp5 43 edge-block-www-env.dropbox-dns.com 162.125.69.15, 443, 49737 DROPBOXUS United States 9->43 45 www-env.dropbox-dns.com 162.125.69.18, 443, 49735 DROPBOXUS United States 9->45 31 C:\ProgramData\...\UpdaterService.exe (copy), PE32 9->31 dropped 33 C:\ProgramData\Updater\Autoit3.exe, PE32 9->33 dropped 18 UpdaterService.exe 1 10 9->18         started        57 Contains functionality to inject threads in other processes 13->57 59 Contains functionality to inject code into remote processes 13->59 61 Contains functionality to detect sleep reduction / modifications 13->61 file6 signatures7 process8 dnsIp9 41 154.216.16.83, 49740, 49741, 49742 SKHT-ASShenzhenKatherineHengTechnologyInformationCo Seychelles 18->41 29 C:\ProgramData\bfadeeb\Autoit3.exe, PE32 18->29 dropped 55 Creates autostart registry keys with suspicious names 18->55 23 cmd.exe 2 18->23         started        file10 signatures11 process12 process13 25 WMIC.exe 1 23->25         started        27 conhost.exe 23->27         started       
Score:
12%
Verdict:
Benign
File Type:
PE
Link:
https://malprob.io/report/9e4f036dd6fbb45ce414cb5d040b3255b5ccc9ecacbfaf022b631545f9a19a02
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9e4f036dd6fbb45ce414cb5d040b3255b5ccc9ecacbfaf022b631545f9a19a02/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tzhqg3ow7o2fzzauznoqiczskw24zspmvs726arlmmkul6nbtiba._file
Verdict:
malicious
Label(s):
darkgate
Create hunting rule
Similar samples:
2ec15fc6c4dfa14162599fd7d46a8c513280ab7dc3a2bb5d7d279f7a10a96697
DarkGate
349fcfd6f24473d8b0c9429c0f71459a178125b6d42a48129d357ce99eca94fe
DarkGate
54f791796231f7899d753f0ba44e7387bf7748dc7a28adbd28f2067c9ab88605
DarkGate
6b2a97d42b3da43843b8cbfc4fa53d954be3b041e853c9cd87bb37fe88a91573
DarkGate
719cf0c9eba47af19500753dc4213f551efdc09f13e2c71ef0e39b08a7aca888
DarkGate
891306bc14e8d196e6f229dfe9d713bb1e81af30efe5ea786672648cbe6fd032
DarkGate
9c46859695bed9bd827e2292e634c39e2982f40d9be6b170d185ae154a1a6a5f
DarkGate
a0ee463632a3799ed2b21d598d1fa8c4ed7198f3debd175a1eb89b2055b57ccd
DarkGate
ae4ccd912a3f2ad87789956660ee5485bb5fcd0f36c1d0d4f1272e3ae1f668f3
DarkGate
error
DarkGate
+ 1'205 additional samples on MalwareBazaar
Result
Malware family:
darkgate
Create hunting rule
Score:
  10/10
Tags:
family:darkgate botnet:rjacline01395 discovery persistence stealer
Link:
https://tria.ge/reports/241214-zepm7svpgk/
Behaviour
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Adds Run key to start application
Checks computer location settings
Executes dropped EXE
DarkGate
Darkgate family
Detect DarkGate stealer
Malware Config
C2 Extraction:
154.216.16.83
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/5e3e7876-9497-49a8-93fe-1267cb45edf6
Unpacked files
SH256 hash:
9e4f036dd6fbb45ce414cb5d040b3255b5ccc9ecacbfaf022b631545f9a19a02
MD5 hash:
8c3ef2eba970f543f0ebe6dced908402
SHA1 hash:
431157eaf15244e5d8cc167511b4611f4dfae85c
Link:
https://www.unpac.me/results/82eaf885-59e8-4f02-8a48-24c8aea9fbf9/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:pe_imphash
Create hunting rule
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

DarkGate

Executable exe 9e4f036dd6fbb45ce414cb5d040b3255b5ccc9ecacbfaf022b631545f9a19a02

(this sample)

DarkGate

f2f20d4232da128f7dedc0edf844a92a3e3f6c8a997fab47777a396b0b4a5f53

DarkGate

zip 3d31b03635eb488ca318f67e3555305a25dc260fe6f5e059e4675b1ae7e026a4

  
Dropping
SHA256 3d31b03635eb488ca318f67e3555305a25dc260fe6f5e059e4675b1ae7e026a4
  
Dropping
MD5 5c7f3935a8ff564e33d8674d4e716a6a
  
Dropping
SHA256 f2f20d4232da128f7dedc0edf844a92a3e3f6c8a997fab47777a396b0b4a5f53
  
Dropping
MD5 3e44fef10a982713adb597df2b72c27f

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high

Comments


Avatar
commented on 2024-12-15 07:56:13 UTC

DarkGate botnet C2:
154.216.16.83:80