🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2e1b612f5183dc842341b0aebb7c2ca51f06632a8331503dd45876b7f7333a8b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DarkGate


Vendor detections: 6


Intelligence 6 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2e1b612f5183dc842341b0aebb7c2ca51f06632a8331503dd45876b7f7333a8b
SHA3-384 hash: 93def9866df0d40aa0615a1333a47e1ca9870cba782fe69d0338b35fdfb5cfca4129236206382d3eece3e46892d77473
SHA1 hash: 111cedc0a22fea1837fa1060bb6cd0d933782525
MD5 hash: 4cb9f50745d7bf8cbcec70c7c4da252c
humanhash: washington-delta-mobile-east
File name:MS_EXCEL_DOCUMENT_HELPER.hta
Download: download sample
Signature DarkGate
Create hunting rule
File size:2'323 bytes
First seen:2024-05-07 10:02:55 UTC
Last seen:2024-05-07 11:16:29 UTC
File type:HTML Application (hta) hta
MIME type:text/html
ssdeep 24:1Ax2kGtrIVsGfqdidVhbCVYIK+no3h25B:1uqly9gUCYIKskh25B
TLSH T1CC417D462DF1CD414A7BDB35907F2801B7E0463187079D83F55CC85507BAF569E876A2
Reporter proxylife
Tags:admin888 DarkGate hta

Intelligence

File Origin
# of uploads :
2
# of downloads :
178
Origin country :
US US
Vendor Threat Intelligence
Result
Verdict:
Malicious
File Type:
HTA File - Malicious
Link:
https://app.docguard.net/2e1b612f5183dc842341b0aebb7c2ca51f06632a8331503dd45876b7f7333a8b/results/dashboard
Behaviour
BlacklistAPI detected
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/6639fc5ff55673e065ac1183/reports/a35f0b2c-4ee8-4681-99fc-b6ac64bc7c4a/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/2e1b612f5183dc842341b0aebb7c2ca51f06632a8331503dd45876b7f7333a8b
Result
Threat name:
DarkGate, MailPassView
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1437386
Signature
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Contains functionality to inject threads in other processes
Found malware configuration
Loading BitLocker PowerShell Module
Machine Learning detection for dropped file
Multi AV Scanner detection for domain / URL
Powershell drops PE file
Sigma detected: Suspicious MSHTA Child Process
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected DarkGate
Yara detected MailPassView
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1437386 Sample: MS_EXCEL_DOCUMENT_HELPER.hta Startdate: 07/05/2024 Architecture: WINDOWS Score: 100 23 updateleft.com 2->23 27 Multi AV Scanner detection for domain / URL 2->27 29 Found malware configuration 2->29 31 Yara detected DarkGate 2->31 33 7 other signatures 2->33 8 mshta.exe 1 2->8         started        signatures3 process4 process5 10 powershell.exe 15 54 8->10         started        dnsIp6 25 updateleft.com 5.252.177.188, 49707, 49708, 80 MIVOCLOUDMD Moldova Republic of 10->25 21 C:\bwjv\Autoit3.exe, PE32 10->21 dropped 35 Loading BitLocker PowerShell Module 10->35 37 Powershell drops PE file 10->37 15 AutoIt3.exe 4 10->15         started        17 conhost.exe 10->17         started        19 attrib.exe 1 10->19         started        file7 signatures8 process9
Score:
3%
Verdict:
Benign
File Type:
SCRIPT
Link:
https://malprob.io/report/2e1b612f5183dc842341b0aebb7c2ca51f06632a8331503dd45876b7f7333a8b
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2e1b612f5183dc842341b0aebb7c2ca51f06632a8331503dd45876b7f7333a8b/
Threat name:
Script-WScript.Downloader.DarkGate
Create hunting rule
Status:
Malicious
First seen:
2024-05-07 08:09:19 UTC
File Type:
Text (HTML)
Extracted files:
1
AV detection:
5 of 38 (13.16%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fynwcl2rqpoiii2bwcxlw7bmuupqmyzkqmyvapoulb3lp5zthkfq._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
execution
Link:
https://tria.ge/reports/240507-l3b55abe3w/
Behaviour
Checks processor information in registry
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Views/modifies file attributes
Command and Scripting Interpreter: PowerShell
Enumerates physical storage devices
Command and Scripting Interpreter: AutoIT
Checks computer location settings
Executes dropped EXE
Blocklisted process makes network request
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/2e1b612f5183dc842341b0aebb7c2ca51f06632a8331503dd45876b7f7333a8b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:QbotStuff
Create hunting rule
Author:anonymous
Rule name:SUSP_OneNote
Create hunting rule
Author:spatronn
Description:Hard-Detect One

File information

The table below shows additional information about this malware sample such as delivery method and external references.

DarkGate

HTML Application (hta) hta 2e1b612f5183dc842341b0aebb7c2ca51f06632a8331503dd45876b7f7333a8b

(this sample)

DarkGate

zip 67ac1d2751e9a8c397cbe16b147a86d6d4b09abfe08e905bd622585ea67203e3

DarkGate

unknown 173874e3043653514f5c49e0fec9473043c6cf9f6c441d23efd8555f0e9f1b90

  
Dropping
SHA256 173874e3043653514f5c49e0fec9473043c6cf9f6c441d23efd8555f0e9f1b90
  
Dropping
MD5 b37f28fd9b296552224c51f74b89321d

Comments