MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 09636b8b2245f94c3117969148d4d5edae984f7128e38bead3f6a7791c85b440. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	09636b8b2245f94c3117969148d4d5edae984f7128e38bead3f6a7791c85b440
SHA3-384 hash:	1a0cd765066c7aa4fa7ad0a55e4827429d10f88627b1722877d3e2064c7bce5cc6e3b951af0d204092d8783dd83e681d
SHA1 hash:	7480111ee7d1e5786ea7a60e3ea77c1d34e91ea3
MD5 hash:	802dc7edf5ab5246f4674ad5a5d67bd4
humanhash:	hamper-maryland-ohio-music
File name:	xahl.zip
Download:	download sample
Signature	DarkGate Alert Create hunting rule
File size:	85'728 bytes
First seen:	2023-10-17 10:11:05 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	1536:UdiqxOyhPgO8X1ZLq9z1WuPOxkqz3uZfT4WsNPjtwS5BtZrGzv5FHvDrD5:Sq1Vc1WuPqbuZfULZ/59GzBp5
TLSH	T1078302638B76104BC0C9B92A47F5FDC37122543B5A6C89334A537AD71807881EBEB57B
TrID	80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	proxylife
Tags:	DarkGate Pikabot zip

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

187

Origin country :

US

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	opt-13.js
File size:	424'070 bytes
SHA256 hash:	c4297432090744d1c7044cd51c3ebac37281619723029612bf6936d928b6e475
MD5 hash:	efd55418b1a9905de5bb94d937b29103
MIME type:	text/plain
Signature	DarkGate

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Sanesecurity.Foxhole.JS_Zip_1.UNOFFICIAL

Alert

Create hunting rule

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

JS File - Malicious

Link:

https://app.docguard.net/09636b8b2245f94c3117969148d4d5edae984f7128e38bead3f6a7791c85b440/results/dashboard

Payload URLs

URL

File name

https://www.nortonlifelock.com/fr/fr/privacy/cookies-and-analytics/

JS File

Behaviour

BlacklistAPI detected

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

cmd lolbin obfuscated ping rundll32

Link:

https://www.filescan.io/uploads/652e5df3d9aa132701852090/reports/2462c371-260b-4066-acd6-e9272f45a87f/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/09636b8b2245f94c3117969148d4d5edae984f7128e38bead3f6a7791c85b440

Nucleon Malprob Benign

Score:

3%

Verdict:

Benign

File Type:

Archive

Link:

https://malprob.io/report/09636b8b2245f94c3117969148d4d5edae984f7128e38bead3f6a7791c85b440

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/09636b8b2245f94c3117969148d4d5edae984f7128e38bead3f6a7791c85b440/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=bfrwxczcix4uymixs2iurvgv5wxjqt3rfdryx2wt62txshefwraa._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

n/a

Link:

https://tria.ge/reports/231017-myek5ach72/

Behaviour

Modifies system certificate store

Runs ping.exe

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks computer location settings

Blocklisted process makes network request

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/09636b8b2245f94c3117969148d4d5edae984f7128e38bead3f6a7791c85b440