🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 196bb36f7d63c845afd40c5c17ce061e320d110f28ebe8c7c998b9e6b3fe1005. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DarkGate


Vendor detections: 5


Intelligence 5 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 196bb36f7d63c845afd40c5c17ce061e320d110f28ebe8c7c998b9e6b3fe1005
SHA3-384 hash: 8e800a77b0c86c90d3ffb1d7a33dd1935570367343c8a4d1f29b104682a973bf69583527659d189bf29d4db39b365a66
SHA1 hash: 2b90f1398b79331e8f853ddb004dcc87a1daf540
MD5 hash: ace67f099683c4360f442c58da66aeba
humanhash: eleven-vegan-sodium-green
File name:report-(390557)-2024.html
Download: download sample
Signature DarkGate
Create hunting rule
File size:3'171 bytes
First seen:2024-03-26 20:58:57 UTC
Last seen:Never
File type: html
MIME type:text/html
ssdeep 48:TmpI3wqR5Trmx09HiFSb7Cz73O9zcBRcjts/W1cs6GNlJi3z4v1iG+5uHZslsV4O:Tm6FLGyhCnOdArNG1iG0is4
TLSH T16051E9A7A158111F7247D3B37072A76D76368113A7030E7474A570E0AECEFA846B72D9
Reporter k3dg3___
Tags:admin888 DarkGate html


Avatar
k3dg3
same campaign as https://tria.ge/240326-sjtz6aga2x

Intelligence

File Origin
# of uploads :
1
# of downloads :
261
Origin country :
US US
Vendor Threat Intelligence
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/196bb36f7d63c845afd40c5c17ce061e320d110f28ebe8c7c998b9e6b3fe1005
Result
Threat name:
n/a
Detection:
malicious
Classification:
phis
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/1416099
Signature
Phishing site detected (based on favicon image match)
Suspicious Javascript code found in HTML file
Behaviour
Behavior Graph:
Download SVG
Score:
0%
Verdict:
Benign
File Type:
SCRIPT
Link:
https://malprob.io/report/196bb36f7d63c845afd40c5c17ce061e320d110f28ebe8c7c998b9e6b3fe1005
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/196bb36f7d63c845afd40c5c17ce061e320d110f28ebe8c7c998b9e6b3fe1005/
Threat name:
Win32.Trojan.PhishHtml
Create hunting rule
Status:
Malicious
First seen:
2024-03-26 14:14:48 UTC
File Type:
Text (HTML)
Extracted files:
2
AV detection:
9 of 23 (39.13%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dfv3g335mpeell6ubrobptqgdyza2eipfdv6rr6jtc46nm76cacq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.70
Link:
https://yomi.yoroi.company/submissions/196bb36f7d63c845afd40c5c17ce061e320d110f28ebe8c7c998b9e6b3fe1005

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:html_auto_download_b64
Create hunting rule
Author:Tdawg
Description:html auto download
Rule name:QbotStuff
Create hunting rule
Author:anonymous
Rule name:yara_template
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

DarkGate

html 196bb36f7d63c845afd40c5c17ce061e320d110f28ebe8c7c998b9e6b3fe1005

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments