🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 902cba22f379a08607515944d8a3ab4718cdc55cc461f1fdb07890b293cd78a0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DarkGate


Vendor detections: 4


Intelligence 4 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 902cba22f379a08607515944d8a3ab4718cdc55cc461f1fdb07890b293cd78a0
SHA3-384 hash: 91c81c230da4f5891bd108968a0028970b6b8bbc0a47a51ecd2431f4bdc2a908800c2847e225841d119ba5bbcce6b8b0
SHA1 hash: 03e8d1b6d538fe696b9c6ef53b4ccd009124fea6
MD5 hash: 10d18d994b942508d7c41ccff264f2bc
humanhash: mexico-tennis-uncle-juliet
File name:u.zip
Download: download sample
Signature DarkGate
Create hunting rule
File size:660'464 bytes
First seen:2023-10-13 13:08:28 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:88Sje/GgRTMzF6sTycGTEWTM0jKt18UPuh4VeCmueYWo0nNHnzB3TPn2f7:8Lje+IT2F6sTycQEmOtV9Nqo2HnzVT2j
TLSH T153E42326414C41B78027749D823826B173EDA3DE328F234E4156BB791B6E6E0DFD6E2D
TrID 80.0% (.ZIP) ZIP compressed archive (4000/1)
20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter proxylife
Tags:DarkGate zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
181
Origin country :
IL IL
File Archive Information

This file archive contains 2 file(s), sorted by their relevance:

File name:Doc-71.txt
File size:14 bytes
SHA256 hash: 7c8c1d24b38f7a04cf51e1b85e84a303b402421d188ac74dd82593fa5c5266ad
MD5 hash: 2c7eeae5b108c18b335aed7421f14cfd
MIME type:text/plain
Signature DarkGate
File name:Doc-71.exe
File size:1'153'056 bytes
SHA256 hash: b79b536569c0060a834e4001289a6700692d67df58e644779fababf0df22fc75
MD5 hash: 2663243d13ad9a58f973a8299c41df07
MIME type:application/x-dosexec
Signature DarkGate
Vendor Threat Intelligence
Result
Verdict:
Unknown
File Type:
PE File
Link:
https://app.docguard.net/902cba22f379a08607515944d8a3ab4718cdc55cc461f1fdb07890b293cd78a0/results/dashboard
Verdict:
No Threat
Threat level:
  10/10
Confidence:
100%
Tags:
greyware overlay packed
Link:
https://www.filescan.io/uploads/6529416e3b921285dcdd8e6a/reports/d9ad7d50-6d1e-45d5-a9d3-17f10e551af8/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/902cba22f379a08607515944d8a3ab4718cdc55cc461f1fdb07890b293cd78a0
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/902cba22f379a08607515944d8a3ab4718cdc55cc461f1fdb07890b293cd78a0/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=sawluixtpgqimb2rlfcnri5li4mm3rk4yrq7d7nqpcilfe6npcqa._file
Result
Malware family:
darkgate
Create hunting rule
Score:
  10/10
Tags:
family:darkgate stealer
Link:
https://tria.ge/reports/231013-qexjdaaa2z/
Behaviour
Checks processor information in registry
DarkGate
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.41
Link:
https://yomi.yoroi.company/submissions/902cba22f379a08607515944d8a3ab4718cdc55cc461f1fdb07890b293cd78a0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments