MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e122ce7c1e43ab9d8ea7d9f078ce588f605010009dbd9a9acea4ec26f57919e1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

DarkGate

Vendor detections: 5

Intelligence 5 IOCs YARA 2 File information Comments

SHA256 hash:	e122ce7c1e43ab9d8ea7d9f078ce588f605010009dbd9a9acea4ec26f57919e1
SHA3-384 hash:	defb785333368fff76910a98b314a295bccaf7f66d5eef4f506c50ad201063fefb5e891bd938df660243dd99e1db6c1e
SHA1 hash:	6f3ea227c6c223bfdea2c6949c2291aa630be553
MD5 hash:	ca8b4396563653be9e1a727d85164cab
humanhash:	bravo-idaho-ack-steak
File name:	Report-119.msi
Download:	download sample
Signature	DarkGate Create hunting rule
File size:	491'520 bytes
First seen:	2023-10-11 10:27:43 UTC
Last seen:	Never
File type:	msi
MIME type:	application/x-msi
ssdeep	12288:StvRQ+gjpjegGao8gAQHmCVAaIxUh6osx:StncpVGq9wqUM
Threatray	120 similar samples on MalwareBazaar
TLSH	T130A4D0613BC9C13AD2AE063785BA8B6626367D751B30D0CBB7903D6C5E316D3E939312
TrID	98.2% (.MSI) Microsoft Windows Installer (454500/1/170) 1.7% (.) Generic OLE2 / Multistream Compound (8000/1)
Reporter	proxylife
Tags:	DarkGate missing-payload msi

Intelligence

File Origin

# of uploads :

# of downloads :

166

Origin country :

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/453184/

Verdict:

No Threat

Threat level:

10/10

Confidence:

100%

Tags:

expand fingerprint lolbin packed shell32

Link:

https://www.filescan.io/uploads/652678b640343f27c6763f67/reports/9052ce06-f3b8-4a4f-becf-a8e56a90b2ef/overview

Verdict:

Suspicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/e122ce7c1e43ab9d8ea7d9f078ce588f605010009dbd9a9acea4ec26f57919e1

Result

Threat name:

n/a

Detection:

clean

Classification:

n/a

Score:

12 / 100

Link:

https://www.joesandbox.com/analysis/1323612

Behaviour

Behavior Graph:

n/a

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e122ce7c1e43ab9d8ea7d9f078ce588f605010009dbd9a9acea4ec26f57919e1/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4erm47a6iovz3dvh3hyhrtsyr5qfaeaatw6zvgwoutwcn5lzdhqq._file

Verdict:

unknown

Result

Malware family:

n/a

Score:

7/10

Tags:

discovery

Link:

https://tria.ge/reports/231011-mhnh4aaf73/

Behaviour

Checks SCSI registry key(s)

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Uses Volume Shadow Copy service COM API

Program crash

Drops file in Windows directory

Enumerates connected drives

Executes dropped EXE

Loads dropped DLL

Modifies file permissions

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/e122ce7c1e43ab9d8ea7d9f078ce588f605010009dbd9a9acea4ec26f57919e1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	maldoc_OLE_file_magic_number Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/453184/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample