MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ee999adf7e49feb5b36b1686e7ce0d5bc3a4321f66b60e50770e0928cba55405. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

DarkVNC

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments

SHA256 hash:	ee999adf7e49feb5b36b1686e7ce0d5bc3a4321f66b60e50770e0928cba55405
SHA3-384 hash:	501a0d1235180ac5c07f58012df86e610f3bec321979c7b37048ecc12dbdfe1044d04dd48824ee5b93281e25a5a72a4a
SHA1 hash:	482abcef779b9d7bee4dad389ea9eac740e3cac7
MD5 hash:	c8fbb42519d331209f459a56974df66a
humanhash:	foxtrot-earth-shade-island
File name:	servces.exe
Download:	download sample
Signature	DarkVNC Create hunting rule
File size:	1'047'552 bytes
First seen:	2021-07-05 10:24:42 UTC
Last seen:	2021-07-05 10:52:34 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	87ce8b0d6c3837192e6d2e355ff9513e (1 x DarkVNC)
ssdeep	24576:qx8AYFRXi/z2upGxSbVV/hXxs4UYrJhYcvpqe0aBkHprxL:qi/iq0GxSBV/VxsKVhFQaBGpd
Threatray	2'390 similar samples on MalwareBazaar
TLSH	9D2522D17A00C8B2D3524430687ADE649270BC6269A7844BF3B57E6FBE3368276F5317
Reporter	CholeVallabh
Tags:	DarkVNC exe

Intelligence

File Origin

# of uploads :

# of downloads :

177

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

https://keygenit.com

Verdict:

Malicious activity

Analysis date:

2021-07-05 09:51:12 UTC

Tags:

evasion trojan rat azorult stealer loader raccoon miner fareit pony opendir danabot unwanted netsupport redline vidar

Link:

https://app.any.run/tasks/ddddfd49-3635-4662-b04c-b2cbbf63f790

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/169721/

Detection(s):

SecuriteInfo.com.W32.AIDetect.malware1.10300.11930.UNOFFICIAL

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Malicious Packer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/f8849619-2558-49c9-bcdb-a3b1c62acccc

Result

Threat name:

Unknown

Detection:

malicious

Classification:

evad

Score:

84 / 100

Link:

https://www.joesandbox.com/analysis/811810

Signature

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Machine Learning detection for sample

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ee999adf7e49feb5b36b1686e7ce0d5bc3a4321f66b60e50770e0928cba55405/

Threat name:

Win32.Trojan.Generic

Status:

Suspicious

First seen:

2021-07-05 10:25:12 UTC

AV detection:

17 of 29 (58.62%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=52mzvx36jh7llm3lc2doptqnlpb2imq7m23a4udxbyesrs5fkqcq._file

Verdict:

malicious

Result

Malware family:

n/a

Score:

8/10

Tags:

n/a

Link:

https://tria.ge/reports/210705-s64ep32msj/

Behaviour

Suspicious use of WriteProcessMemory

Loads dropped DLL

Blocklisted process makes network request

Unpacked files

SH256 hash:

0600054154dd2219a872e248c2d87a17b01b4785801c72a7b940677362bd8d0a

MD5 hash:

1f3f867708886bce9e9638d143541047

SHA1 hash:

3fc4115d6528e39b74e45d4d0f78a694974d8cf5

Link:

https://www.unpac.me/results/a7c91aeb-471b-4af7-b155-03a758c99d33/

SH256 hash:

b14fd4403367c8b4fad94ef364da5a87810084e1ea85a7afe7561526652b147e

MD5 hash:

b9a716170fd766573f922f063af764b2

SHA1 hash:

11ef3ae86f77b949c77dd6d90e4803ca8fef98dc

Link:

https://www.unpac.me/results/a7c91aeb-471b-4af7-b155-03a758c99d33/

SH256 hash:

ee999adf7e49feb5b36b1686e7ce0d5bc3a4321f66b60e50770e0928cba55405

MD5 hash:

c8fbb42519d331209f459a56974df66a

SHA1 hash:

482abcef779b9d7bee4dad389ea9eac740e3cac7

Link:

https://www.unpac.me/results/a7c91aeb-471b-4af7-b155-03a758c99d33/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/ee999adf7e49feb5b36b1686e7ce0d5bc3a4321f66b60e50770e0928cba55405

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture Create hunting rule
Author:	ditekSHen
Description:	Detect executables with stomped PE compilation timestamp that is greater than local current time