MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f14f422727fb4f22d7b21dc063d20f05ff8cff2f40ad88bc73fe3de7ced2e834. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

DarkVNC

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	f14f422727fb4f22d7b21dc063d20f05ff8cff2f40ad88bc73fe3de7ced2e834
SHA3-384 hash:	925d5421dfec9ac541f7d3a5c5c2bafbb0f641d20988b7be51bd8b05c75cda44e26524053100c142ce6d0829e4d0fa3f
SHA1 hash:	50778dc6cd991822f90ca6fb26e671389fbe1b5b
MD5 hash:	cac9a83408c30ff0709660369cfd0d63
humanhash:	jig-alaska-lion-nebraska
File name:	SecuriteInfo.com.W32.AIDetect.malware1.5881.18966
Download:	download sample
Signature	DarkVNC Create hunting rule
File size:	1'170'944 bytes
First seen:	2021-07-09 08:05:54 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	1dd63394b7581f644406e79aaff7117c (2 x DarkVNC)
ssdeep	24576:lnH8DpE0bZPqNeA5Lz/FUXKrWzctsVwXZUKA1Vd5g+fg+UIcmMyGQl73:ZH4Pq4wf/2Qt1XZUf19g+fgtyGI
Threatray	2'477 similar samples on MalwareBazaar
TLSH	T10A450110BAA0C039E5F722F4497A83A8632E7AB19F2040CBF2D566ED57356E09DF1717
Reporter	SecuriteInfoCom
Tags:	DarkVNC exe

Intelligence

File Origin

# of uploads :

# of downloads :

129

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

schhosts.exe

Verdict:

Malicious activity

Analysis date:

2021-07-09 05:01:57 UTC

Tags:

trojan danabot stealer

Link:

https://app.any.run/tasks/69ecac45-049d-41ea-812f-9fa5f67e55e7

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/170625/

Detection(s):

SecuriteInfo.com.W32.AIDetect.malware1.5881.18966.UNOFFICIAL

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Malicious Packer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/be928f17-47c0-4e9f-973d-bbbd61f60493

Result

Threat name:

DarkVNC

Detection:

malicious

Classification:

bank.troj.adwa.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/813893

Signature

Bypasses PowerShell execution policy

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Enables a proxy for the internet explorer

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sets a proxy for the internet explorer

System process connects to network (likely due to code injection or exploit)

Tries to harvest and steal browser information (history, passwords, etc)

Uses nslookup.exe to query domains

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected DarkVNC

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f14f422727fb4f22d7b21dc063d20f05ff8cff2f40ad88bc73fe3de7ced2e834/

Verdict:

malicious

Result

Malware family:

n/a

Score:

8/10

Tags:

discovery spyware stealer

Link:

https://tria.ge/reports/210709-lp2w532qva/

Behaviour

Checks processor information in registry

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Drops file in Program Files directory

Suspicious use of SetThreadContext

Checks installed software on the system

Loads dropped DLL

Reads user/profile data of web browsers

Blocklisted process makes network request

Unpacked files

SH256 hash:

dd681c4cd117cf44f6cef5d2e2b2efa7f192839b363324165959828c6c45afc3

MD5 hash:

a4a40ab802a4867eee4a33b22f8cfc08

SHA1 hash:

1d61da825e63f4eacb138ff22187fbcc6702c66b

Link:

https://www.unpac.me/results/e1741b88-c22d-411b-ba73-d4426760ac9d/

SH256 hash:

e01b654e0bce9ec88dd2708f55efb6e7a08b5e5531984c3dc9c05cce71b4fa6e

MD5 hash:

9488afd5fb961b77673cdc6161c18051

SHA1 hash:

29084ed072e96a9cc7d9498ac892174e379c0e0d

Link:

https://www.unpac.me/results/e1741b88-c22d-411b-ba73-d4426760ac9d/

SH256 hash:

f14f422727fb4f22d7b21dc063d20f05ff8cff2f40ad88bc73fe3de7ced2e834

MD5 hash:

cac9a83408c30ff0709660369cfd0d63

SHA1 hash:

50778dc6cd991822f90ca6fb26e671389fbe1b5b

Link:

https://www.unpac.me/results/e1741b88-c22d-411b-ba73-d4426760ac9d/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f14f422727fb4f22d7b21dc063d20f05ff8cff2f40ad88bc73fe3de7ced2e834

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture Create hunting rule
Author:	ditekSHen
Description:	Detect executables with stomped PE compilation timestamp that is greater than local current time