🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b9aeb7f233ebc00cfe8be8832a8eb48d2c1e5bfa69cfdba4ecc9ee054e55b59f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DarkGate


Vendor detections: 6


Intelligence 6 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b9aeb7f233ebc00cfe8be8832a8eb48d2c1e5bfa69cfdba4ecc9ee054e55b59f
SHA3-384 hash: 8db92866632dc7c02bb3ff54c23930b82d0f6071c2cdc03a0d75e12805da98967cb90f55801083b46705b932e07fbe24
SHA1 hash: e43e20c942ad06433ffee8ec7b04bb384973d5d7
MD5 hash: 691cb50fb8459ffacfcb82cfacb6feb6
humanhash: fish-march-florida-zulu
File name:1.msi
Download: download sample
Signature DarkGate
Create hunting rule
File size:1'839'925 bytes
First seen:2023-09-25 16:58:50 UTC
Last seen:Never
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 49152:epUPfjpSNeHaHGYayNId4pWL56Hq05vHjYL57CBN4/6sT:epeeHGKId+W1n6/01kN4ysT
TLSH T1E185129137D8C635CA8A073645BAC7753666BCB01F30D0CFA3A57E689B326D3A935312
TrID 98.2% (.MSI) Microsoft Windows Installer (454500/1/170)
1.7% (.) Generic OLE2 / Multistream Compound (8000/1)
Reporter malwarelabnet
Tags:94-228-169-143 DarkGate msi

Intelligence

File Origin
# of uploads :
1
# of downloads :
145
Origin country :
CA CA
Vendor Threat Intelligence
Detection(s):
MiscreantPunch.SingleXOR.EXE.227.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.PWS.Banker1.30494.UNOFFICIAL
Create hunting rule

Verdict:
No Threat
Threat level:
  10/10
Confidence:
100%
Tags:
expand fingerprint lolbin packed shell32
Link:
https://www.filescan.io/uploads/6511bc5833582f234e02af6d/reports/740c980f-19c4-4731-8cc8-b420269a04b3/overview
Verdict:
Suspicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/b9aeb7f233ebc00cfe8be8832a8eb48d2c1e5bfa69cfdba4ecc9ee054e55b59f
Result
Threat name:
DarkGate
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/1314070
Signature
C2 URLs / IPs found in malware configuration
Contains functionality to detect sleep reduction / modifications
Contains functionality to modify clipboard data
Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected DarkGate
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1314070 Sample: 1.msi Startdate: 25/09/2023 Architecture: WINDOWS Score: 76 43 94.228.169.143 SSERVICE-ASRU Russian Federation 2->43 45 Found malware configuration 2->45 47 Multi AV Scanner detection for submitted file 2->47 49 Yara detected DarkGate 2->49 51 C2 URLs / IPs found in malware configuration 2->51 9 msiexec.exe 8 19 2->9         started        12 msiexec.exe 5 2->12         started        signatures3 process4 file5 39 C:\Windows\Installer\MSIF3A5.tmp, PE32 9->39 dropped 41 C:\Windows\Installer\MSIE5BE.tmp, PE32 9->41 dropped 14 msiexec.exe 5 9->14         started        process6 process7 16 expand.exe 11 14->16         started        19 KeyScramblerLogon.exe 2 14->19         started        22 icacls.exe 14->22         started        24 icacls.exe 14->24         started        file8 29 C:\Users\user\...\keyscrambler.sys (copy), PE32 16->29 dropped 31 C:\Users\user\...\Uninstall.exe (copy), PE32 16->31 dropped 33 C:\Users\...\KeyScramblerLogon.exe (copy), PE32 16->33 dropped 37 7 other files (5 malicious) 16->37 dropped 35 C:\Users\user\AppData\Local\...\Autoit3.exe, PE32 19->35 dropped 53 Contains functionality to detect sleep reduction / modifications 19->53 26 Autoit3.exe 19->26         started        signatures9 process10 signatures11 55 Contains functionality to modify clipboard data 26->55
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b9aeb7f233ebc00cfe8be8832a8eb48d2c1e5bfa69cfdba4ecc9ee054e55b59f/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xgxlp4rt5paaz7ul5cbsvdvuruwb4w72nhh5xjhmzhxaktsvwwpq._file
Result
Malware family:
darkgate
Create hunting rule
Score:
  10/10
Tags:
family:darkgate discovery stealer
Link:
https://tria.ge/reports/230925-vhdynahb91/
Behaviour
Checks SCSI registry key(s)
Checks processor information in registry
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Uses Volume Shadow Copy service COM API
NSIS installer
Drops file in Windows directory
Enumerates connected drives
Executes dropped EXE
Loads dropped DLL
Modifies file permissions
DarkGate
Malware Config
C2 Extraction:
http://94.228.169.143
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.40
Link:
https://yomi.yoroi.company/submissions/b9aeb7f233ebc00cfe8be8832a8eb48d2c1e5bfa69cfdba4ecc9ee054e55b59f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:maldoc_OLE_file_magic_number
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments