MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c40ec260d9696bf067e8f20f23de6176c44dfe5032015cae668c368a04e3cdd7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	c40ec260d9696bf067e8f20f23de6176c44dfe5032015cae668c368a04e3cdd7
SHA3-384 hash:	28dde9396815e8e4b769ca75a11ba1b90cff2d50e0460461162d56dfeeb6333d65af86f32e4e59b3922dee651a70a3a6
SHA1 hash:	2d3cb40fb64321c343380f701aa84b9653b0a9d3
MD5 hash:	457f92980b658c7332928d72faff99a9
humanhash:	fifteen-neptune-undress-papa
File name:	neverban_ucirgM.vbs
Download:	download sample
Signature	DarkGate Alert Create hunting rule
File size:	1'875 bytes
First seen:	2023-09-26 08:17:59 UTC
Last seen:	2023-09-26 08:23:02 UTC
File type:	vbs
MIME type:	text/plain
ssdeep	48:4onCJVDHVxaM65t67ZUeLbk8RQ3cow87QW43mHqtzvO5E:PsavD61VDQMowy42Kta5E
TLSH	T12031841FD64A009153D62342F542A823BC950290A749D232ECEADA591EE24E849E52BE
Reporter	JAMESWT_WT
Tags:	89-23-100-222 DarkGate vbs

Intelligence

---

File Origin

# of uploads :

3

# of downloads :

150

Origin country :

IT

Vendor Threat Intelligence

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/451197/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Script.SNH-gen.21682.18400.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

anti-vm

Link:

https://www.filescan.io/uploads/651293bb33582f234e035250/reports/73f1a635-ec67-4a2e-a65b-5be229e46c67/overview

Hybrid Analysis Trojan.VBS.SAgent

Verdict:

Suspicious

Labled as:

Trojan.VBS.SAgent

Link:

https://www.hybrid-analysis.com/sample/c40ec260d9696bf067e8f20f23de6176c44dfe5032015cae668c368a04e3cdd7

Joe Sandbox DarkGate, Raccoon Stealer v2

Result

Threat name:

DarkGate, Raccoon Stealer v2

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1314350

Signature

Allocates memory in foreign processes

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Connects to many ports of the same IP (likely port scanning)

Creates a thread in another existing process (thread injection)

DLL side loading technique detected

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Leaks process information

Multi AV Scanner detection for domain / URL

Potential malicious VBS script found (has network functionality)

Potential malicious VBS script found (suspicious strings)

Sigma detected: DarkGate

Snort IDS alert for network traffic

System process connects to network (likely due to code injection or exploit)

Tries to delay execution (extensive OutputDebugStringW loop)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Uses known network protocols on non-standard ports

Uses ping.exe to check the status of other devices and networks

VBScript performs obfuscated calls to suspicious functions

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Yara detected DarkGate

Yara detected Raccoon Stealer v2

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c40ec260d9696bf067e8f20f23de6176c44dfe5032015cae668c368a04e3cdd7/

ReversingLabs TitaniumCloud Script-WScript.Trojan.Darkgate

Threat name:

Script-WScript.Trojan.Darkgate

Alert

Create hunting rule

Status:

Suspicious

First seen:

2023-09-26 08:12:46 UTC

File Type:

Text (VBS)

AV detection:

6 of 24 (25.00%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=yqhmeygznfv7az7i6ihshxtbo3ce37sqgiavzltgrq3iubhdzxlq._file

Threatray unknown

Verdict:

unknown

Hatching Triage raccoon

Result

Malware family:

raccoon

Alert

Create hunting rule

Score:

  10/10

Tags:

family:darkgate family:raccoon botnet:5deca8f8467af8bb055ed4c7694228bf stealer

Link:

https://tria.ge/reports/230926-j69vfsgh78/

Behaviour

Checks processor information in registry

Runs ping.exe

Script User-Agent

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

Suspicious use of SetThreadContext

Checks computer location settings

Drops startup file

Executes dropped EXE

Blocklisted process makes network request

Downloads MZ/PE file

DarkGate

Raccoon

Raccoon Stealer payload

Suspicious use of NtCreateUserProcessOtherParentProcess

Malware Config

C2 Extraction:

http://66.42.63.27
http://91.103.252.209:80/

VMRay Malicious

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/c40ec260d969/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/c40ec260d9696bf067e8f20f23de6176c44dfe5032015cae668c368a04e3cdd7

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/451197/