MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e7019ee941b030e2c7e900bbfc11a0145bb929f02a73d62a419086b800cdce9c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DarkGate


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e7019ee941b030e2c7e900bbfc11a0145bb929f02a73d62a419086b800cdce9c
SHA3-384 hash: 3e9d2d28de38cc674bff125ae1545db89844f42900eadb200ec573d93c555b01cf972b524caee88197731b643c3277a6
SHA1 hash: 62fe93798aee7b1b56995fc71b5898ea7eea5977
MD5 hash: 42ca6af5adb394e032da28f1be48a6ef
humanhash: potato-social-north-kentucky
File name:e91874c5d8c2.zip
Download: download sample
Signature DarkGate
Create hunting rule
File size:8'969'993 bytes
First seen:2023-11-10 19:09:02 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 196608:y7+I99B3JuiGrp99Xdh3D7tvY0XXAvgHugP1e7hdu3BhDCPW+1:yb9B8iGr79X7tvY0XX2Y1G4CPn1
TLSH T1D796333DA11D9B02F00B1779C24B78456394A74C9BD923A74E9880FB22A9F5D4FA1DCF
TrID 80.0% (.ZIP) ZIP compressed archive (4000/1)
20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter abuse_ch
Tags:botnet-user_871236672 DarkGate zip


Avatar
abuse_ch
DarkGate malware distributed via malspam, luring people into clicking an open redirect on DoubleClick:
https://adclick.g.doubleclick.net/pcs/click?adurl=https://posicionamientonatural.es/
-> https://posicionamientonatural.es/wp-content/uploads/2023/11/2/3/P757DS2612-nv.url
--> http://5.181.159.32/Downloads/e91874c5d8c2.zip

DarkGate botnet C2:
http://adhufdauifadhj13.com:2351/ (195.123.233.126 - Green Floid LLC, USA)

Botnet:
botnet-user_871236672

Intelligence

File Origin
# of uploads :
1
# of downloads :
206
Origin country :
CH CH
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:e91874c5d8c2.msi
File size:9'109'504 bytes
SHA256 hash: 8b6c6c007efa8e1a7da241564142f8a8a934dcce451c7e522cdd86292e81ead7
MD5 hash: 1170e2b02b92895d9db0be336d032d90
MIME type:application/x-msi
Signature DarkGate
Vendor Threat Intelligence
Detection(s):
TwinWave.EvilMSI.PkillImAfraidOfUnregisteredMSIinstallers.20231026.UNOFFICIAL
Create hunting rule

Result
Verdict:
Unknown
File Type:
ZIP File
Link:
https://app.docguard.net/e7019ee941b030e2c7e900bbfc11a0145bb929f02a73d62a419086b800cdce9c/results/dashboard
Verdict:
No Threat
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug expand fingerprint hacktool installer lolbin packed shell32
Link:
https://www.filescan.io/uploads/654e800b4b55303a8b7fcc33/reports/ece83abd-ecbd-445b-a546-241ba80d15a3/overview
Verdict:
Malicious
Link:
https://www.hybrid-analysis.com/sample/e7019ee941b030e2c7e900bbfc11a0145bb929f02a73d62a419086b800cdce9c
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/e7019ee941b030e2c7e900bbfc11a0145bb929f02a73d62a419086b800cdce9c
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e7019ee941b030e2c7e900bbfc11a0145bb929f02a73d62a419086b800cdce9c/
Threat name:
Win32.Trojan.DarkGate
Create hunting rule
Status:
Malicious
First seen:
2023-11-10 19:10:06 UTC
File Type:
Binary (Archive)
Extracted files:
225
AV detection:
13 of 23 (56.52%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=44az52kbwayofr7jac57yenacrn3skpqfjz5mksbscdlqagnz2oa._file
Result
Malware family:
darkgate
Create hunting rule
Score:
  10/10
Tags:
family:darkgate botnet:user_871236672 discovery stealer
Link:
https://tria.ge/reports/231110-xvc81ach8x/
Behaviour
Checks SCSI registry key(s)
Checks processor information in registry
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Uses Volume Shadow Copy service COM API
Drops file in Windows directory
Enumerates connected drives
Executes dropped EXE
Loads dropped DLL
Modifies file permissions
DarkGate
Malware Config
C2 Extraction:
http://adhufdauifadhj13.com
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
DarkGate
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e7019ee941b030e2c7e900bbfc11a0145bb929f02a73d62a419086b800cdce9c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:maldoc_OLE_file_magic_number
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DarkGate

952adea6ba0359839498c2f4ce4f27a62b38e42a47d10c91d37ea2e37b90379f

DarkGate

zip e7019ee941b030e2c7e900bbfc11a0145bb929f02a73d62a419086b800cdce9c

(this sample)

DarkGate

Microsoft Software Installer (MSI) msi 8b6c6c007efa8e1a7da241564142f8a8a934dcce451c7e522cdd86292e81ead7

  
URLhaus
https://urlhaus.abuse.ch/url/2729735/
  
Link
https://threatfox.abuse.ch/ioc/1201513/
  
Link
https://threatfox.abuse.ch/ioc/1201514/
  
Link
https://threatfox.abuse.ch/ioc/1198873/
  
Dropped by
MD5 c4b22a73ea5b08bfc06228c11a447af9
  
Dropped by
SHA256 952adea6ba0359839498c2f4ce4f27a62b38e42a47d10c91d37ea2e37b90379f
  
Dropping
MD5 1170e2b02b92895d9db0be336d032d90
  
Dropping
SHA256 8b6c6c007efa8e1a7da241564142f8a8a934dcce451c7e522cdd86292e81ead7
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2729734/

Comments