MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ce3f1d357e4e27f1dd49c3c6901e9a9c52179cfbc66824fe1dee181a7896ce9e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	ce3f1d357e4e27f1dd49c3c6901e9a9c52179cfbc66824fe1dee181a7896ce9e
SHA3-384 hash:	9d2ba92bf1184c6a49d24e0caa5a39798541ffa49918d63c18c4c9f90b2b7573781d74f7e522b92b1a90689a3f61c0d7
SHA1 hash:	a2fd0922e47ca651e1213bd30bf0922067d53ac1
MD5 hash:	6dc286f30c31f186ed724b0c29942352
humanhash:	enemy-bluebird-green-freddie
File name:	zckgnyuh.bat
Download:	download sample
Signature	DarkGate Alert Create hunting rule
File size:	225 bytes
First seen:	2023-09-17 06:40:08 UTC
Last seen:	Never
File type:	bat
MIME type:	text/plain
ssdeep	6:4I5fJQO3glQ/mxiPU7Cwz3HiPUKyGvFxPOwD:4I5FgK+xmYCwzXmT9uwD
TLSH	T118D0A73F266F41E6F550AEE920B690D5E0A7248F03680D1C6EE44CCC840844BD50E9D4
Reporter	JAMESWT_WT
Tags:	bat DarkGate zochao-com

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

173

Origin country :

IT

Vendor Threat Intelligence

ANY.RUN

Malware family:

n/a

ID:

1

File name:

zckgnyuh.bat

Verdict:

No threats detected

Analysis date:

2023-09-17 13:38:19 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/8b246d30-620d-4a92-b677-bcc53c67164e

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/449101/

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

86%

Link:

https://www.filescan.io/uploads/65069f7e83a0c6425df74fb2/reports/46178718-c728-4e4f-add0-adce583269c9/overview

Hybrid Analysis BAT/TrojanDownloader.Agent

Verdict:

Suspicious

Labled as:

BAT/TrojanDownloader.Agent

Link:

https://www.hybrid-analysis.com/sample/ce3f1d357e4e27f1dd49c3c6901e9a9c52179cfbc66824fe1dee181a7896ce9e

Joe Sandbox DarkGate

Result

Threat name:

DarkGate

Alert

Create hunting rule

Detection:

malicious

Classification:

troj

Score:

68 / 100

Link:

https://www.joesandbox.com/analysis/1309550

Signature

Multi AV Scanner detection for domain / URL

Snort IDS alert for network traffic

Uses known network protocols on non-standard ports

Yara detected DarkGate

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ce3f1d357e4e27f1dd49c3c6901e9a9c52179cfbc66824fe1dee181a7896ce9e/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=zy7r2nl6jyt7dxkjypdjahu2trjbphh3yzucj7q55ymbu6ewz2pa._file

Threatray unknown

Verdict:

unknown

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

n/a

Link:

https://tria.ge/reports/230917-hfrqhsfh8s/

Behaviour

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Drops startup file

Executes dropped EXE

Downloads MZ/PE file

Suspicious use of NtCreateUserProcessOtherParentProcess

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.20

Link:

https://yomi.yoroi.company/submissions/ce3f1d357e4e27f1dd49c3c6901e9a9c52179cfbc66824fe1dee181a7896ce9e

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/449101/