🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0bae047a2fecd7a081f9980a7f754af4fa0c9e5eb41b937ab8448ef50edf820f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DarkGate


Vendor detections: 8


Intelligence 8 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0bae047a2fecd7a081f9980a7f754af4fa0c9e5eb41b937ab8448ef50edf820f
SHA3-384 hash: 5554408006fc756e392b55cc1359934f5ce675bdfccbe65eb279ee03ce32471ed15980aa0115f4ea0b3edd14c5b97fa8
SHA1 hash: 56adfe7fe3715265f22e770cc3e555ef2f9f9c4d
MD5 hash: 1f70fb6ce081900dbf96b51204bd1ea3
humanhash: kansas-hot-kentucky-tennessee
File name:WTUW.zip
Download: download sample
Signature DarkGate
Create hunting rule
File size:68'964 bytes
First seen:2023-11-15 11:57:49 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 1536:P2LY/m7c+C2BWCrb1ckCms/Pw2qFUlNtOmascDhuHzRgbj9u5:OLYe7rfrb1cZmcPDvLascDhAOA
TLSH T12B6301A91F45ACD28BE8B0CC165A1E6A5CB48A5FDB706DBD0EB047E38BDC1174F83106
TrID 80.0% (.ZIP) ZIP compressed archive (4000/1)
20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter proxylife
Tags:A11111 DarkGate faststroygo-com zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
240
Origin country :
FI FI
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:JNVEEN.js
File size:242'706 bytes
SHA256 hash: c788100411c38388afc3438dccc05297ac7a77083f579e4a7e8d6e1479214fde
MD5 hash: ea6fd6ca47514d9c632c119d73aef528
MIME type:text/html
Signature DarkGate
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.JS_Zip_1.UNOFFICIAL
Create hunting rule

TwinWave.EvilJS.AXONestedFunction.20230731.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malicious
File Type:
JS File - Malicious
Link:
https://app.docguard.net/0bae047a2fecd7a081f9980a7f754af4fa0c9e5eb41b937ab8448ef50edf820f/results/dashboard
Payload URLs
URL
File name
https://github.com/kriskowal/es5-shim/blob/master/es5-shim.js
JS File
Behaviour
BlacklistAPI detected
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
88%
Link:
https://www.filescan.io/uploads/6554b27f28bfca96f8acf08a/reports/5fc46335-b132-4d75-bb09-2c9c80fe13b3/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/0bae047a2fecd7a081f9980a7f754af4fa0c9e5eb41b937ab8448ef50edf820f
Score:
38%
Verdict:
Susipicious
File Type:
Archive
Link:
https://malprob.io/report/0bae047a2fecd7a081f9980a7f754af4fa0c9e5eb41b937ab8448ef50edf820f
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0bae047a2fecd7a081f9980a7f754af4fa0c9e5eb41b937ab8448ef50edf820f/
Threat name:
Script-JS.Backdoor.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2023-11-15 11:58:05 UTC
File Type:
Binary (Archive)
Extracted files:
1
AV detection:
4 of 38 (10.53%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=boxai6rp5tl2bapztafh65kk6t5azhs6wqnzg6vyishpkdw7qihq._file
Result
Malware family:
darkgate
Create hunting rule
Score:
  10/10
Tags:
family:darkgate botnet:a11111 stealer
Link:
https://tria.ge/reports/231115-p4832acb6z/
Behaviour
Checks processor information in registry
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks computer location settings
Executes dropped EXE
Blocklisted process makes network request
Downloads MZ/PE file
DarkGate
Suspicious use of NtCreateUserProcessOtherParentProcess
Malware Config
C2 Extraction:
http://faststroygo.com
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0bae047a2fecd7a081f9980a7f754af4fa0c9e5eb41b937ab8448ef50edf820f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:QbotStuff
Create hunting rule
Author:anonymous
Rule name:SUSP_obfuscated_JS_obfuscatorio
Create hunting rule
Author:@imp0rtp3
Description:Detect JS obfuscation done by the js obfuscator (often malicious)
Reference:https://obfuscator.io
Rule name:yara_template
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments