MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4c4a5c51dc3e8cf6b2a3f6fd54008593002daa180fe73489e93da5e0d152be4f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	4c4a5c51dc3e8cf6b2a3f6fd54008593002daa180fe73489e93da5e0d152be4f
SHA3-384 hash:	9b116404115debb6cbc71696fa2d0229e4782de0dface727088c600dc0232b4db4260694305e9d11d96607e9e0d25e14
SHA1 hash:	356a4b9d823703d240d1b1967ddb345118a129a7
MD5 hash:	d6b313db30bdee5611135842893c038b
humanhash:	moon-hamper-skylark-twenty
File name:	bye.zip
Download:	download sample
Signature	DarkGate Alert Create hunting rule
File size:	8'314 bytes
First seen:	2023-10-02 18:23:31 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	192:+RBfgP3tKk4wuMCkjJ0rAphB+oHq4rUQPfP4UHF37aozQG:sBoPdKbweoZKw7f5FL/UG
TLSH	T1FA02BF1E1A4D0955D702F1B4EA65330690BD8ECF1B423EE6CA5254B38B77114AF33275
TrID	80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	1ZRR4H
Tags:	DarkGate greadeaoptimalle-com searcherbigdealk-com zip

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

148

Origin country :

CL

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	bye.vbs
File size:	20'013 bytes
SHA256 hash:	7d4115e88411e7bcac9ed622dbb6554ff4015c6f9fed98a5427970ceada526e6
MD5 hash:	a19d814f720701a258a6e8b5a22b22c9
MIME type:	text/plain
Signature	DarkGate

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Sanesecurity.Foxhole.JS_Zip_1v.UNOFFICIAL

Alert

Create hunting rule

DocGuard Unknown

Result

Verdict:

Unknown

File Type:

ZIP File

Link:

https://app.docguard.net/4c4a5c51dc3e8cf6b2a3f6fd54008593002daa180fe73489e93da5e0d152be4f/results/dashboard

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/651b0ac240343f27c670efc7/reports/01b4d3c7-4fdd-4082-9be8-1efbf146a707/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/4c4a5c51dc3e8cf6b2a3f6fd54008593002daa180fe73489e93da5e0d152be4f

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/4c4a5c51dc3e8cf6b2a3f6fd54008593002daa180fe73489e93da5e0d152be4f

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4c4a5c51dc3e8cf6b2a3f6fd54008593002daa180fe73489e93da5e0d152be4f/

ReversingLabs TitaniumCloud Win32.Trojan.Generic

Threat name:

Win32.Trojan.Generic

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-10-02 18:24:04 UTC

File Type:

Binary (Archive)

Extracted files:

1

AV detection:

2 of 38 (5.26%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=jrffyuo4h2gpnmvd636viaefsmac3kqyb7ttjcpjhws6buksxzhq._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI DarkGate

Threat name:

DarkGate

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/4c4a5c51dc3e8cf6b2a3f6fd54008593002daa180fe73489e93da5e0d152be4f