MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2e1bcf78fc03408afbd8f0eee3607b40780cc0362145c0ca9c2e063f7d33fd40. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

DarkGate

Vendor detections: 5

Intelligence 5 IOCs YARA 5 File information Comments

SHA256 hash:	2e1bcf78fc03408afbd8f0eee3607b40780cc0362145c0ca9c2e063f7d33fd40
SHA3-384 hash:	ec42d9819b1b6422cb3c47eeba1b5faa5754926eb89a47b0e367d43112c3d41284fc398ea945ceec4e3d25dd8d9794f7
SHA1 hash:	5dd3ef94eb39f8b2f567ebfcc7806a4d332381cb
MD5 hash:	92df4fed3c92f414527be714440772d6
humanhash:	quiet-maryland-vermont-leopard
File name:	reincarnation.zip
Download:	download sample
Signature	DarkGate Create hunting rule
File size:	1'808'242 bytes
First seen:	2024-01-29 16:07:39 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	49152:fpLb0Su/b92dsv3EHXFqWFvy83BQ8+E/D/eczvdczG:RH5HNnI8H/bzvia
TLSH	T1B68533FAD3D3BC2064947EB1CA51AEE751C5A001A6FA34361E294DC2706C5BAC87F5CE
TrID	80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	rmceoin
Tags:	DarkGate zip

rmceoin

Found here 5.181.159.23/Downloads/reincarnation.zip

Intelligence

File Origin

# of uploads :

# of downloads :

263

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	reincarnation.msi
File size:	3'936'256 bytes
SHA256 hash:	9c71b3dd94329b2649fd36ccd5f0df919126284883543cff573e103076ce3506
MD5 hash:	4b2e289610400400a87a347ac2010c59
MIME type:	application/x-msi
Signature	DarkGate

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Win64.InjectorX-gen.2055.10202.UNOFFICIAL

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

expand fingerprint installer lolbin packed shell32

Link:

https://www.filescan.io/uploads/65b7cd724e14bc829403f8f7/reports/b8af15d5-49ef-4102-879a-fd5a860da96d/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/2e1bcf78fc03408afbd8f0eee3607b40780cc0362145c0ca9c2e063f7d33fd40

Score:

Verdict:

Benign

File Type:

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AutoIT_Script Create hunting rule
Author:	@bartblaze
Description:	Identifies AutoIT script. This rule by itself does NOT necessarily mean the detected file is malicious.

Rule name:	Borland Create hunting rule
Author:	malware-lu

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	maldoc_OLE_file_magic_number Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	SUSP_XORed_MSDOS_Stub_Message Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious XORed MSDOS stub message
Reference:	https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings