MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eb40273cc80a326126fdc5eecac7a0805f33c071e8e435814c3d04bc48d04878. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

DarkVNC

Vendor detections: 7

Intelligence 7 IOCs YARA 2 File information Comments

SHA256 hash:	eb40273cc80a326126fdc5eecac7a0805f33c071e8e435814c3d04bc48d04878
SHA3-384 hash:	8bba600e38ae60a583877e9bbadd67c8c943ffc3159f90351b7fc6cb2534c97319221911671d96679f3631dae301038f
SHA1 hash:	ffc9ee3773dd9351a28f2fe37ecfdbc1fcb6d579
MD5 hash:	1148ef649e923055e9868f63afeb9a04
humanhash:	carolina-texas-ink-idaho
File name:	1148ef649e923055e9868f63afeb9a04
Download:	download sample
Signature	DarkVNC Create hunting rule
File size:	558'030 bytes
First seen:	2021-06-17 07:11:54 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	be41bf7b8cc010b614bd36bbca606973 (195 x LummaStealer, 126 x DanaBot, 63 x Vidar)
ssdeep	12288:q0g/ExkFffdyZTg1JRuEafRM07aGfo4yGPMYhdLoKw34Ck1uF2Yk:lef1ZqJa3GDUb3rJk
Threatray	200 similar samples on MalwareBazaar
TLSH	53C412472F8D8475FAAD0F319DBB73621A7BFC296874D21B6302BC4D6831502E925F29
Reporter	zbetcheckin
Tags:	32 DarkVNC exe

Intelligence

File Origin

# of uploads :

# of downloads :

109

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

208e8dd08e5487af9ec875fef96c168a.exe

Verdict:

Malicious activity

Analysis date:

2021-06-17 06:50:26 UTC

Tags:

stealer trojan loader

Link:

https://app.any.run/tasks/ced1af21-cce0-4a48-a4d4-4b34e11996f8

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/166515/

Detection(s):

Win.Packed.Filerepmalware-9864117-0

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

IntelRapid

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/6e4defe7-a376-4a50-8c9e-ccda0dd7cc98

Result

Threat name:

Clipboard Hijacker

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/803550

Signature

Antivirus / Scanner detection for submitted sample

Delayed program exit found

Detected unpacking (overwrites its own PE header)

Found malware configuration

Machine Learning detection for dropped file

Machine Learning detection for sample

May check the online IP address of the machine

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: WScript or CScript Dropper

System process connects to network (likely due to code injection or exploit)

Yara detected Clipboard Hijacker

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/eb40273cc80a326126fdc5eecac7a0805f33c071e8e435814c3d04bc48d04878/

Threat name:

Win32.Trojan.AntiVM

Status:

Malicious

First seen:

2021-06-17 07:12:09 UTC

AV detection:

15 of 46 (32.61%)

Threat level:

5/5

Verdict:

suspicious

Result

Malware family:

n/a

Score:

8/10

Tags:

discovery spyware stealer

Link:

https://tria.ge/reports/210617-j5e4f183da/

Behaviour

Checks processor information in registry

Modifies registry class

Modifies system certificate store

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Drops file in Program Files directory

Suspicious use of SetThreadContext

Checks installed software on the system

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Drops startup file

Loads dropped DLL

Reads user/profile data of web browsers

Blocklisted process makes network request

Downloads MZ/PE file

Executes dropped EXE

Unpacked files

SH256 hash:

cae2af36f866fed9753ecc423bf1cfb3d1b5f2c3179dddc1715d6c896812d669

MD5 hash:

0fcc3d7408dfb7b31d8e36982dab298c

SHA1 hash:

6ebe13e8565ab5cfc7f8eac8973c156531b2a1e2

Link:

https://www.unpac.me/results/f9c1c11e-9962-4242-a15b-cfc57ba18e0a/

SH256 hash:

4943c8b62aa4b7031c91156ef5ea477b788aa7a8b0d9481a9e687a9db46077cd

MD5 hash:

3a07f32cfa51ee98dd3cb5d9efcf76b4

SHA1 hash:

402bce76ae7825b5a70f41f98bf22c45cbcb2065

Link:

https://www.unpac.me/results/f9c1c11e-9962-4242-a15b-cfc57ba18e0a/

SH256 hash:

eb40273cc80a326126fdc5eecac7a0805f33c071e8e435814c3d04bc48d04878

MD5 hash:

1148ef649e923055e9868f63afeb9a04

SHA1 hash:

ffc9ee3773dd9351a28f2fe37ecfdbc1fcb6d579

Link:

https://www.unpac.me/results/f9c1c11e-9962-4242-a15b-cfc57ba18e0a/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/eb40273cc80a326126fdc5eecac7a0805f33c071e8e435814c3d04bc48d04878

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu Create hunting rule
Author:	ditekSHen
Description:	Detect executables with stomped PE compilation timestamp that is greater than local current time