🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eb7ef73bba6d4ce4dc2d427ab11177e72793a46db1f1b7240e04a1d3c1a6d5bb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DarkGate


Vendor detections: 5


Intelligence 5 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: eb7ef73bba6d4ce4dc2d427ab11177e72793a46db1f1b7240e04a1d3c1a6d5bb
SHA3-384 hash: bba9c8e67c4adb17e973694f9656ccb4d023d59fa17f30b6540fc53009738d14ae6f491ab81bbcb7362c5f89b98d2aec
SHA1 hash: 1bf78848f55bd12c97adf85fce9088ada694c280
MD5 hash: 331d90bce0cd39ade939239ed7119141
humanhash: chicken-wolfram-pennsylvania-kilo
File name:400eed.msi
Download: download sample
Signature DarkGate
Create hunting rule
File size:10'285'056 bytes
First seen:2023-08-23 01:33:40 UTC
Last seen:Never
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 196608:Nt7mCnm12dSug1dBX/ul7BCp7+iMNyBv6eWSEvlvBP7EESjj:vqCnC4SZ1dBPC7q6NAWSE9N7vSf
Threatray 654 similar samples on MalwareBazaar
TLSH T1B0A63342AAD5E772E329153919AF8B7922737CA83730E4DF3B1439045BB27E38975306
TrID 86.3% (.MSI) Microsoft Windows Installer (454500/1/170)
8.4% (.MSP) Windows Installer Patch (44509/10/5)
3.7% (.WPS) Kingsoft WPS Office document (alt.) (19502/3/2)
1.5% (.) Generic OLE2 / Multistream Compound (8000/1)
Reporter 1ZRR4H
Tags:DarkGate msi

Intelligence

File Origin
# of uploads :
1
# of downloads :
223
Origin country :
CA CA
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/444252/
Gathering data
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/eb7ef73bba6d4ce4dc2d427ab11177e72793a46db1f1b7240e04a1d3c1a6d5bb
Result
Threat name:
Darkgate
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/1295593
Signature
Contains functionality to modify clipboard data
Creates a thread in another existing process (thread injection)
Document exploit detected (process start blacklist hit)
Sample uses string decryption to hide its real strings
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected Darkgate
Yara detected WebBrowserPassView password recovery tool
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1295593 Sample: 400eed.msi Startdate: 23/08/2023 Architecture: WINDOWS Score: 72 76 Yara detected Darkgate 2->76 78 Sample uses string decryption to hide its real strings 2->78 80 Document exploit detected (process start blacklist hit) 2->80 82 Yara detected WebBrowserPassView password recovery tool 2->82 10 msiexec.exe 8 17 2->10         started        13 Autoit3.exe 2->13         started        15 msiexec.exe 3 2->15         started        process3 file4 68 C:\Windows\Installer\MSI17E7.tmp, PE32 10->68 dropped 70 C:\Windows\Installer\MSI10C3.tmp, PE32 10->70 dropped 17 msiexec.exe 5 10->17         started        19 cmd.exe 13->19         started        process5 signatures6 22 AutoIt3.exe 8 17->22         started        26 expand.exe 35 17->26         started        28 icacls.exe 17->28         started        30 icacls.exe 17->30         started        84 Creates a thread in another existing process (thread injection) 19->84 32 MyProg.exe 19->32         started        process7 file8 58 C:\temp\AutoIt3.exe, PE32 22->58 dropped 90 Contains functionality to modify clipboard data 22->90 34 cmd.exe 3 22->34         started        39 AcroRd32.exe 29 22->39         started        60 C:\Users\user\AppData\...\mspatchc.dll (copy), PE32 26->60 dropped 62 C:\Users\user\AppData\...\mergemod.dll (copy), PE32 26->62 dropped 64 C:\Users\user\AppData\...\melt.exe (copy), PE32 26->64 dropped 66 31 other files (none is malicious) 26->66 dropped 41 Wkconv.exe 32->41         started        43 ADelRCP.exe 32->43         started        signatures9 process10 dnsIp11 74 107.181.161.200, 443, 49165, 49167 TOTAL-SERVER-SOLUTIONSUS United States 34->74 56 C:\ProgramData\bhecbcf\Autoit3.exe, PE32 34->56 dropped 86 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 34->86 88 Creates a thread in another existing process (thread injection) 34->88 45 AdobeCollabSync.exe 34->45         started        47 FullTrustNotifier.exe 34->47         started        49 RdrCEF.exe 2 39->49         started        52 pipanel.exe 39->52         started        file12 signatures13 process14 dnsIp15 54 jusched.exe 45->54         started        72 192.168.2.255, 137, 138 unknown unknown 49->72 process16
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/eb7ef73bba6d4ce4dc2d427ab11177e72793a46db1f1b7240e04a1d3c1a6d5bb/
Threat name:
Script-AutoIt.Trojan.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2023-08-21 11:06:46 UTC
File Type:
Binary (Archive)
Extracted files:
234
AV detection:
11 of 36 (30.56%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5n7poo52nvgojxbnij5lcelx44tzhjdnwhy3ojaoasq5hqng2w5q._file
Verdict:
malicious
Similar samples:
06724c588f5b9381effa96ca72ae6c136b6ec64ae1e898942d34142e40078bab
DarkGate
164f6dd9a77be0fc7425a9f97873435bdade7dc85da44c27474d2187395dfac6
DarkGate
21ada98043ea73edf58648a2a43856bed7f8e9fafdc948aae020b1dbb3053d90
DarkGate
72c22d9c2150b022f3f15e30bfd2d76435d4091b99a0e443c96dcb4c48aa5539
DarkGate
93320dc79416b00e3e78f70e316e4f6d35eb99360b305a706582b845953e1f62
DarkGate
9f6eb963b28951006fa6254b74f58b087c4469496c8ab22cf74210510f82c186
DarkGate
a0ee463632a3799ed2b21d598d1fa8c4ed7198f3debd175a1eb89b2055b57ccd
DarkGate
c01dabdb1e0572151396954fd7bcd7334cee5b1d64de29b7de21c14eafbd6416
DarkGate
d3821c1a2684e27713730b1c44580b734ba9517b099fa71cad7b1b6764e5bcad
DarkGate
faec9f2bb4da32ed322a8d98e634997ba23d2b28aa64a2efe7d49d6bb2f15467
DarkGate
+ 644 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
discovery
Link:
https://tria.ge/reports/230823-by4dpsgh73/
Behaviour
Modifies Internet Explorer settings
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Windows directory
Suspicious use of SetThreadContext
Enumerates connected drives
Drops startup file
Executes dropped EXE
Loads dropped DLL
Modifies file permissions
Blocklisted process makes network request
Suspicious use of NtCreateUserProcessOtherParentProcess
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/eb7ef73bba6d/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.40
Link:
https://yomi.yoroi.company/submissions/eb7ef73bba6d4ce4dc2d427ab11177e72793a46db1f1b7240e04a1d3c1a6d5bb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:maldoc_OLE_file_magic_number
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/444252/

Comments