MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1f8a3ec047e0f44f1f21e1e3f8af5ea32749ecac3e2bef4fc2ba1a2006934581. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Gamaredon

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments

SHA256 hash:	1f8a3ec047e0f44f1f21e1e3f8af5ea32749ecac3e2bef4fc2ba1a2006934581
SHA3-384 hash:	cbd7b18575d457704dd318710145e077fe9587385767f12219a5386ecbb10a0f434d62666edbc8f26a5d13a26ab8d25c
SHA1 hash:	546fe4df4e2fc95a88716e472b37a89821fdd50e
MD5 hash:	f308215cc6b4586d48ccc791947c437d
humanhash:	lemon-music-nine-beer
File name:	darted.ps1
Download:	download sample
Signature	Gamaredon Create hunting rule
File size:	173'317 bytes
First seen:	2025-11-23 17:37:44 UTC
Last seen:	Never
File type:	ps1
MIME type:	text/html
ssdeep	3072:aALnsl6ItI/J0E0Rxz3zZOPkgVXf/8ptbq/AYboQSlxwZht:aasl6ItI/J0E0PzdOPkhptsAYqwx
TLSH	T196047D669E8932248BBA570295DF3C8167D6530BB9721C8EB50C90CD82FF5E4E6CD0BD
Magika	vba
Reporter	M128BitOff
Tags:	apt gamaredon ps1 pteranodon Pterodo

M128BitOff

This malware sample was downloaded from Gamaredons Payload Delivery Infrastructure in the following analysis:
https://blog.synapticsystems.de/inside-gamaredon-2025-zero-click-espionage-at-scale/

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Gathering data

Verdict:

Malicious

Score:

81.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6923468cbaf0edd59969ff40

Tags:

virus

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

evasive

Link:

https://www.filescan.io/uploads/6923468aeecb08e4aa45f507/reports/0bae296c-8733-4947-b3d7-95ce45f3b23f/overview

Verdict:

Suspicious

Labled as:

TrojanDownloader/VBS.NetLoader

Link:

https://www.hybrid-analysis.com/sample/1f8a3ec047e0f44f1f21e1e3f8af5ea32749ecac3e2bef4fc2ba1a2006934581

Result

Gathering data

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/1f8a3ec047e0f44f1f21e1e3f8af5ea32749ecac3e2bef4fc2ba1a2006934581

Verdict:

Malware

YARA:

3 match(es)

Tags:

adodb.stream Base64 Block Contains Base64 Block Html msxml2.domdocument.3.0 msxml2.xmlhttp Scripting.FileSystemObject vbscript.regexp WScript.Shell

Link:

https://app.malva.re/file/f308215cc6b4586d48ccc791947c437d

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1f8a3ec047e0f44f1f21e1e3f8af5ea32749ecac3e2bef4fc2ba1a2006934581/

Verdict:

Malicious

Threat:

Worm.Script

Link:

https://tip.neiki.dev/file/1f8a3ec047e0f44f1f21e1e3f8af5ea32749ecac3e2bef4fc2ba1a2006934581

Threat name:

Script-WScript.Trojan.Gamaredon

Status:

Malicious

First seen:

2025-11-23 17:38:20 UTC

File Type:

Text (HTML)

Extracted files:

AV detection:

2 of 36 (5.56%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=d6fd5qch4d2e6hzb4hr7rl26umtut3fmhyv66t6cxincabutiwaq._file

Result

Malware family:

n/a

Score:

4/10

Tags:

discovery

Link:

https://tria.ge/reports/251123-v7t16svkcm/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Modifies data under HKEY_USERS

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Browser Information Discovery

Drops file in Program Files directory

Drops file in Windows directory

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.30

Link:

https://yomi.yoroi.company/submissions/1f8a3ec047e0f44f1f21e1e3f8af5ea32749ecac3e2bef4fc2ba1a2006934581

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.