MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dfb4fb4b9a7dc426394dc235ab703a35d7c9f45e4f40dadcda22d67d80d9f1de. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DarkVNC


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dfb4fb4b9a7dc426394dc235ab703a35d7c9f45e4f40dadcda22d67d80d9f1de
SHA3-384 hash: b3528be6f4418d18fe224aa064fa521d3d000d66b7bab8fbad16ec32d3b2bd1c71baddcdbb4218ccc5482f1827a042f6
SHA1 hash: a9dcfb0e199af9dd328ffd089d42347b866b5e6e
MD5 hash: 16655736e9b057b7b03f931e15e52a1e
humanhash: thirteen-grey-rugby-charlie
File name:16655736e9b057b7b03f931e15e52a1e
Download: download sample
Signature DarkVNC
Create hunting rule
File size:1'102'848 bytes
First seen:2021-07-10 09:24:29 UTC
Last seen:2021-07-10 09:34:28 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 0ca800e5917b37d4675d52303cb1287e (1 x TeamBot, 1 x DarkVNC, 1 x CryptBot)
ssdeep 24576:77ZNc3GSRYlDd/nlbIoGDQrQA7ZbITAHAsdN70uVfVRea9Ej5:4fRA9lEoomZbo8VRg
Threatray 2'507 similar samples on MalwareBazaar
TLSH T1233502307AA0C034E5A306F5957893B464397D729F2841CBF2967BEB66356D89CF0393
Reporter zbetcheckin
Tags:32 DarkVNC exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
164
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
16655736e9b057b7b03f931e15e52a1e
Verdict:
Malicious activity
Analysis date:
2021-07-10 09:27:48 UTC
Tags:
trojan danabot
Link:
https://app.any.run/tasks/c559a48b-80ce-4e87-82fa-a336ec8eae09

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Blackrat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/170793/
Detection(s):
SecuriteInfo.com.Trojan.Siggen14.30825.29810.8863.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/26f35309-13be-4743-92ce-0abce6a594ad
Result
Threat name:
DarkVNC
Create hunting rule
Detection:
malicious
Classification:
bank.troj.adwa.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/814306
Signature
Bypasses PowerShell execution policy
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Enables a proxy for the internet explorer
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sets a proxy for the internet explorer
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal browser information (history, passwords, etc)
Yara detected DarkVNC
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 446717 Sample: zzEmHNb8Ka Startdate: 10/07/2021 Architecture: WINDOWS Score: 100 40 Multi AV Scanner detection for submitted file 2->40 42 Yara detected DarkVNC 2->42 44 Machine Learning detection for sample 2->44 9 zzEmHNb8Ka.exe 1 2->9         started        process3 signatures4 54 Detected unpacking (changes PE section rights) 9->54 56 Detected unpacking (overwrites its own PE header) 9->56 12 rundll32.exe 6 9->12         started        process5 dnsIp6 38 192.236.161.79, 443, 49728, 49747 HOSTWINDSUS United States 12->38 32 C:\ProgramData\Bklngfpngf\kgjocbpkfku.tmp, PE32 12->32 dropped 34 C:\Users\user\Desktop\zzEmHNb8Ka.exe, data 12->34 dropped 58 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 12->58 60 Bypasses PowerShell execution policy 12->60 17 rundll32.exe 10 23 12->17         started        file7 signatures8 process9 dnsIp10 36 127.0.0.1 unknown unknown 17->36 30 C:\Users\user\AppData\...\tmpB518.tmp.ps1, ASCII 17->30 dropped 46 System process connects to network (likely due to code injection or exploit) 17->46 48 Tries to harvest and steal browser information (history, passwords, etc) 17->48 50 Sets a proxy for the internet explorer 17->50 52 Enables a proxy for the internet explorer 17->52 22 powershell.exe 17 17->22         started        24 powershell.exe 3 17->24         started        file11 signatures12 process13 process14 26 conhost.exe 22->26         started        28 conhost.exe 24->28         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dfb4fb4b9a7dc426394dc235ab703a35d7c9f45e4f40dadcda22d67d80d9f1de/
Threat name:
Win32.Trojan.Zenpak
Create hunting rule
Status:
Malicious
First seen:
2021-07-10 09:25:07 UTC
AV detection:
12 of 46 (26.09%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
0e987602142e521bab7a311b02a5856d89a07f41c74a3bbb2b8a2ecddcaa9655
DarkVNC
26e4bbe3bdc2deb3142b952094d6bd3bb27ee0217d7a9b735a0cc2bbdf6bd9b4
DarkVNC
4a79f527d403fdfec5bf88068a5ac86494395d0b735ac27741a4ff78b2434a55
DarkVNC
6d4e6d54d7fb566e6887ce79f7d65c151b3092260cc7fef21dc60d46a265b4ff
DarkVNC
90ef0dacd3f993a784a8f2d884e065704920db45a5abe639f714306b89a2eef8
DarkVNC
9edc8848e696b6b61cec52ea4d298f22d4475286ed89cf153816ed262f822fdb
DarkVNC
ab7e6dc61621c75a72207bad8a4f3bb1f0a9f1feb515cc1cd3be01009133fc48
DarkVNC
d24b2f6e96fa1b2bb20b19e3b70757887a3f4934d035fde4efdbdd5b9e845df9
DarkVNC
d7199616185a4d6187eb375c778dd4e5327df6a5e51018770addb54705732d88
DarkVNC
ef41d62dadb36c9f3eec74500f82a6694ebe728a1fedc2bc7120b925e8b831fb
DarkVNC
+ 2'497 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery spyware stealer
Link:
https://tria.ge/reports/210710-qejxqskyrs/
Behaviour
Checks processor information in registry
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Suspicious use of SetThreadContext
Checks installed software on the system
Loads dropped DLL
Reads user/profile data of web browsers
Blocklisted process makes network request
Unpacked files
SH256 hash:
5ef78eb6376b36a9385df7c9e5ce50767fe673a317fb0b20b5db79bcb86a327a
MD5 hash:
681d0e90fa6854d0a32e269a03f1c8a5
SHA1 hash:
e49010652ab87302e514ee1db98b38f2694b5d18
Link:
https://www.unpac.me/results/7bda364d-531e-42cd-bfc2-0cd41fedd33e/
SH256 hash:
7c6d07f1ee7f6543b656e594ea3ce337434e17a86605e457a34dbf47f1430e5a
MD5 hash:
c9838c008a4b5e2a8f0b5cea5c471e9f
SHA1 hash:
98cc17aacbf6e730bbccd5dcec64d09de3ee9cb6
Link:
https://www.unpac.me/results/7bda364d-531e-42cd-bfc2-0cd41fedd33e/
SH256 hash:
dfb4fb4b9a7dc426394dc235ab703a35d7c9f45e4f40dadcda22d67d80d9f1de
MD5 hash:
16655736e9b057b7b03f931e15e52a1e
SHA1 hash:
a9dcfb0e199af9dd328ffd089d42347b866b5e6e
Link:
https://www.unpac.me/results/7bda364d-531e-42cd-bfc2-0cd41fedd33e/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/dfb4fb4b9a7dc426394dc235ab703a35d7c9f45e4f40dadcda22d67d80d9f1de

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DarkVNC

Executable exe dfb4fb4b9a7dc426394dc235ab703a35d7c9f45e4f40dadcda22d67d80d9f1de

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/170793/
  
URLhaus
https://urlhaus.abuse.ch/url/1407122/
  
URLhaus
https://urlhaus.abuse.ch/url/1437896/

Comments


Avatar
zbet commented on 2021-07-10 09:24:32 UTC

url : hxxp://23.254.225.193/servces.exe