🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 be69add1213202bc7a038a2cfb2cf8ece07eeaaf163c2e17873c54d303e3abfa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DarkGate


Vendor detections: 7


Intelligence 7 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: be69add1213202bc7a038a2cfb2cf8ece07eeaaf163c2e17873c54d303e3abfa
SHA3-384 hash: 7992c605171f8d30841b6a6bd0f66149f7ab79d3075e65d4a40d05fe712590ab105aced1a45adc820ee36a750f9bd543
SHA1 hash: 41f971c1cbb03545225fa7816708bfb322fbba95
MD5 hash: 40804163b8e3cb4cfb6dc6984a1e228f
humanhash: apart-burger-six-mississippi
File name:p_terminal_x86_install.msi
Download: download sample
Signature DarkGate
Create hunting rule
File size:2'342'912 bytes
First seen:2023-09-14 07:01:16 UTC
Last seen:2023-09-14 12:36:47 UTC
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 49152:hpUPh/aSZVfoL5/esFPZPEN5YYCusbwy19m3zca16l+:hpg/NHAosF6N5YYubNjCM+
Threatray 96 similar samples on MalwareBazaar
TLSH T1B7B523513BD9C63ADADE0736847A87253236BD601F30E0CFAA95396D47337E26938352
TrID 98.2% (.MSI) Microsoft Windows Installer (454500/1/170)
1.7% (.) Generic OLE2 / Multistream Compound (8000/1)
Reporter 1ZRR4H
Tags:178-236-247-102 DarkGate msi PFO GROUP LLC

Intelligence

File Origin
# of uploads :
2
# of downloads :
157
Origin country :
CL CL
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/448547/
Detection(s):
MiscreantPunch.SingleXOR.EXE.213.UNOFFICIAL
Create hunting rule

Verdict:
No Threat
Threat level:
  10/10
Confidence:
100%
Tags:
expand fingerprint lolbin packed shell32
Link:
https://www.filescan.io/uploads/6502afeb25e2ece4df6d9964/reports/404435df-9893-4bb8-83cb-2d211afb86af/overview
Verdict:
Malicious
Labled as:
Generik.FFWZFNM trojan
Link:
https://www.hybrid-analysis.com/sample/be69add1213202bc7a038a2cfb2cf8ece07eeaaf163c2e17873c54d303e3abfa
Result
Threat name:
DarkGate
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/1307700
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
Connects to many ports of the same IP (likely port scanning)
Contains functionality to detect sleep reduction / modifications
Creates a thread in another existing process (thread injection)
Found malware configuration
Initial sample is a PE file and has a suspicious name
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Sigma detected: Scheduled temp file as task from temp location
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected AgentTesla
Yara detected AntiVM3
Yara detected DarkGate
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1307700 Sample: p_terminal_x86_install.msi Startdate: 14/09/2023 Architecture: WINDOWS Score: 68 78 Yara detected DarkGate 2->78 80 Connects to many ports of the same IP (likely port scanning) 2->80 10 msiexec.exe 3 16 2->10         started        13 msiexec.exe 5 2->13         started        15 TabTip32.exe 2->15         started        17 24 other processes 2->17 process3 file4 62 C:\Windows\Installer\MSIB3CD.tmp, PE32 10->62 dropped 64 C:\Windows\Installer\MSI720F.tmp, PE32 10->64 dropped 19 msiexec.exe 5 10->19         started        process5 process6 21 KeyScramblerLogon.exe 2 19->21         started        25 expand.exe 26 19->25         started        27 icacls.exe 1 19->27         started        29 2 other processes 19->29 file7 52 C:\Users\user\AppData\Local\...\Autoit3.exe, PE32 21->52 dropped 82 Contains functionality to detect sleep reduction / modifications 21->82 31 Autoit3.exe 1 8 21->31         started        54 C:\Users\user\...\keyscrambler.sys (copy), PE32 25->54 dropped 56 C:\Users\user\...\Uninstall.exe (copy), PE32 25->56 dropped 58 C:\Users\user\...\QFXUpdateService.exe (copy), PE32 25->58 dropped 60 13 other files (none is malicious) 25->60 dropped 35 conhost.exe 25->35         started        37 conhost.exe 27->37         started        39 conhost.exe 29->39         started        signatures8 process9 file10 68 C:\temp\AutoIt3.exe, PE32 31->68 dropped 72 Writes to foreign memory regions 31->72 74 Allocates memory in foreign processes 31->74 76 Creates a thread in another existing process (thread injection) 31->76 41 cmd.exe 6 31->41         started        46 xRzJrXJdKemcsBAR.exe 31->46 injected signatures11 process12 dnsIp13 70 178.236.247.102, 27850, 9999 PRANET-ASRU Russian Federation 41->70 66 C:\ProgramData\afddhec\Autoit3.exe, PE32 41->66 dropped 84 Creates a thread in another existing process (thread injection) 41->84 48 TabTip32.exe 41->48         started        50 TabTip32.exe 41->50         started        file14 signatures15 process16
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/be69add1213202bc7a038a2cfb2cf8ece07eeaaf163c2e17873c54d303e3abfa/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xzu23ujbgibly6qdriwpwlhy5tqh52vpcy6c4f4hhrknga7dvp5a._file
Verdict:
malicious
Similar samples:
0e01bad874c61d09d09ce06f76f5e46f6648a1fc943644874c8e1a53a93af9a7
DarkGate
2eede34adc2a44e96acfdfb9f3dfba2df4ad17f9fdf76970ad02d5596c1a50a5
DarkGate
5b608a6729343cf8b6752d5bb201f906920fcb472f5949e04173b907f65ceff1
DarkGate
5be83d13f20b4a044a8c8281d13723a808555cdd73a7ddcec37422a4e44fbd4e
DarkGate
6e068b9dcd8df03fd6456faeb4293c036b91a130a18f86a945c8964a576c1c70
DarkGate
9a7db0204847d26515ed249f9ed577220326f63a724a2e0fb6bb1d8cd33508a3
DarkGate
+ 86 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
discovery
Link:
https://tria.ge/reports/230914-htr87scg29/
Behaviour
Checks SCSI registry key(s)
Checks processor information in registry
Enumerates system info in registry
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Uses Volume Shadow Copy service COM API
NSIS installer
Enumerates physical storage devices
Drops file in Windows directory
Suspicious use of SetThreadContext
Enumerates connected drives
Drops startup file
Executes dropped EXE
Loads dropped DLL
Modifies file permissions
Blocklisted process makes network request
Suspicious use of NtCreateUserProcessOtherParentProcess
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/be69add12132/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.63
Link:
https://yomi.yoroi.company/submissions/be69add1213202bc7a038a2cfb2cf8ece07eeaaf163c2e17873c54d303e3abfa

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:maldoc_OLE_file_magic_number
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/448547/

Comments