MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 004dc00f66098d37167a52a7fc0814f497d30814dc00a8da7083a4765510d79a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

DarkGate

Vendor detections: 5

Intelligence 5 IOCs YARA 6 File information Comments

SHA256 hash:	004dc00f66098d37167a52a7fc0814f497d30814dc00a8da7083a4765510d79a
SHA3-384 hash:	77177502917430e2af10af120e62947b0e57df51924fa5d98e0e42c3e5abbedcc490ec956fe75a54da47912247e35fed
SHA1 hash:	83b19553e9027dcc21efa10f85fa867ec14f28af
MD5 hash:	56453f4255cf8b57ecebab1bb1c41589
humanhash:	grey-mississippi-winner-cold
File name:	pullofmaster.zip
Download:	download sample
Signature	DarkGate Create hunting rule
File size:	2'271'220 bytes
First seen:	2024-01-29 19:41:22 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	49152:RRXNYFRA4azy37q/riun5EKeeKTc6KKJ6NjK2cFnd5PfZ:RNNYFR/Oy3WFn5EKzOc6Jyc1dFZ
TLSH	T11DB533ED632E187844C5AA62838F5F44358C255FE2A3748DCDC20B2D9FFE498E52619F
TrID	80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	rmceoin
Tags:	DarkGate zip

rmceoin

Found here 5.181.159.23/Downloads/pullofmaster.zip

Intelligence

File Origin

# of uploads :

# of downloads :

260

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	pullofmaster.msi
File size:	4'554'752 bytes
SHA256 hash:	fc6ab939f5f2d6f12cb1edbe2babd5b180d8d036fc0b37a77f784d1c52162112
MD5 hash:	b88352bde539f79207be209759505f02
MIME type:	application/x-msi
Signature	DarkGate

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Win64.InjectorX-gen.20927.23994.UNOFFICIAL

Verdict:

No Threat

Threat level:

2.5/10

Confidence:

100%

Tags:

expand fingerprint installer lolbin packed shell32

Link:

https://www.filescan.io/uploads/65b7ff980eab2d1605495828/reports/f5abefef-aa01-4d1a-b8ee-89881d927a02/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/004dc00f66098d37167a52a7fc0814f497d30814dc00a8da7083a4765510d79a

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/004dc00f66098d37167a52a7fc0814f497d30814dc00a8da7083a4765510d79a

Score:

Verdict:

Benign

File Type:

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AutoIT_Script Create hunting rule
Author:	@bartblaze
Description:	Identifies AutoIT script. This rule by itself does NOT necessarily mean the detected file is malicious.

Rule name:	BitcoinAddress Create hunting rule
Author:	Didier Stevens (@DidierStevens)
Description:	Contains a valid Bitcoin address

Rule name:	Borland Create hunting rule
Author:	malware-lu

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	maldoc_OLE_file_magic_number Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	SUSP_XORed_MSDOS_Stub_Message Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious XORed MSDOS stub message
Reference:	https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings