MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 79e9ac00c9d012518a4b97e6eca876fb1546cd8f3fe23978acdf7f2c612e030d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DarkGate


Vendor detections: 5


Intelligence 5 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 79e9ac00c9d012518a4b97e6eca876fb1546cd8f3fe23978acdf7f2c612e030d
SHA3-384 hash: cee81b3e73683365d295134dc6eb21ad0ffcfda9ac1fb9059704bf843c56e2d9bad289120daff6b8291f0acddaa1632e
SHA1 hash: c75ac3267b9c955bf9f791b362e493eb05dded2f
MD5 hash: d1a71a98f042d00a5cf30aec9bec6378
humanhash: iowa-lima-mississippi-idaho
File name:sec_may_445515.html
Download: download sample
Signature DarkGate
Create hunting rule
File size:91'848 bytes
First seen:2024-05-17 16:27:22 UTC
Last seen:Never
File type: html
MIME type:text/html
ssdeep 1536:Og3Sr5VMemXYRgBI3kkM7mC7aeWccn5H3SJQrd5MWnA:/3YmF4M7mC7bRcnUJIdGWA
TLSH T15D938C376518758EEB676E6032115510FCE65023EA47E88D3ECCD39226E7CC8E46CB97
Reporter k3dg3___
Tags:admin888 DarkGate html my

Intelligence

File Origin
# of uploads :
1
# of downloads :
256
Origin country :
US US
Vendor Threat Intelligence
Detection(s):
TwinWave.EvilHTML.DarkGate.LoveUAnyway.UNOFFICIAL
Create hunting rule

TwinWave.EvilHTML.DarkGatePicturesOfU.240516.UNOFFICIAL
Create hunting rule

Verdict:
No Threat
Threat level:
  2.5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/66478593bc04dffa921e07a9/reports/000ea632-50ef-44c8-90cf-55887ad7798b/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/79e9ac00c9d012518a4b97e6eca876fb1546cd8f3fe23978acdf7f2c612e030d
Result
Threat name:
n/a
Detection:
clean
Classification:
n/a
Score:
1 / 100
Link:
https://www.joesandbox.com/analysis/1443412
Behaviour
Behavior Graph:
n/a
Score:
67%
Verdict:
Susipicious
File Type:
SCRIPT
Link:
https://malprob.io/report/79e9ac00c9d012518a4b97e6eca876fb1546cd8f3fe23978acdf7f2c612e030d
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/79e9ac00c9d012518a4b97e6eca876fb1546cd8f3fe23978acdf7f2c612e030d/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=phu2yagj2ajfdcsls7tozkdw7mkuntmph7rds6fm357syyjoamgq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
DarkGate
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/79e9ac00c9d012518a4b97e6eca876fb1546cd8f3fe23978acdf7f2c612e030d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:html_auto_download_b64
Create hunting rule
Author:Tdawg
Description:html auto download
Rule name:QbotStuff
Create hunting rule
Author:anonymous
Rule name:yara_template
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

DarkGate

html 79e9ac00c9d012518a4b97e6eca876fb1546cd8f3fe23978acdf7f2c612e030d

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments