MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ca388a52c69865829152ec89665ebdaa1b2a77dea74973352287c3a37fa1e206. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DarkGate


Vendor detections: 9


Intelligence 9 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ca388a52c69865829152ec89665ebdaa1b2a77dea74973352287c3a37fa1e206
SHA3-384 hash: 26eab6e7e349fd378b484fbc379d75f48815b8b1536e98107d92e504f043c5d7130f3d9e0f749d2b28d22c0be4538ee6
SHA1 hash: 23d43373e72c6d3e525877db2335218a64f10b3e
MD5 hash: 915034264360cd02a671861c0822eb65
humanhash: moon-michigan-december-zulu
File name:1040doc_pdf.lnk
Download: download sample
Signature DarkGate
Create hunting rule
File size:3'220 bytes
First seen:2024-03-05 20:36:46 UTC
Last seen:Never
File type:Shortcut (lnk) lnk
MIME type:application/octet-stream
ssdeep 24:8N/ByKntyFB+/ljsrQxZ0Hc4ncPOcVdd79dsrab/U3IV:8tPtyFMjnxZ0Hc4ncP/VdJ9AabU3K
TLSH T1E361F728DED90229F6B24B758BE76213F836B842FA5DCE09019303491461790D5FAF6E
Reporter rmceoin
Tags:lnk


Avatar
rmceoin
91.92.245.222/Downloads/1040doc_pdf.lnk
lastmodified: Tue, 05 Mar 2024 09:29:11 GMT
LNK -> mshta http://168.100.8.242/dc001/1040_document_pdf -> http://168.100.8.242/dc001/1040documentpdf.vbs

91.92.245.222/Downloads/a.lnk
lastmodified: Tue, 05 Mar 2024 19:25:22 GMT

Intelligence

File Origin
# of uploads :
1
# of downloads :
197
Origin country :
US US
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.29668.LnkHeur.UNOFFICIAL
Create hunting rule

TwinWave.EvilLNK.LOLBinOddLookPSHELL.20220711.UNOFFICIAL
Create hunting rule

TwinWave.EvilLNK.OddLook.202207213.UNOFFICIAL
Create hunting rule

TwinWave.EvilLNK.DriftingApart.20220214.UNOFFICIAL
Create hunting rule

TwinWave.EvilLNK.KingForADaypshell.20231121.UNOFFICIAL
Create hunting rule

TwinWave.EvilLNK.OtherPosition.02122024.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malicious
File Type:
LNK File - Malicious
Link:
https://app.docguard.net/ca388a52c69865829152ec89665ebdaa1b2a77dea74973352287c3a37fa1e206/results/dashboard
Behaviour
BlacklistAPI detected
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
evasive lolbin masquerade syncappvpublishingserver
Link:
https://www.filescan.io/uploads/65e7826faa3c088d605d0083/reports/322f0a58-1614-4a3a-ba2a-81699c30bd89/overview
Verdict:
Malicious
Labled as:
LNK/TrojanDownloader.Agent
Link:
https://www.hybrid-analysis.com/sample/ca388a52c69865829152ec89665ebdaa1b2a77dea74973352287c3a37fa1e206
Result
Verdict:
MALICIOUS
Result
Threat name:
n/a
Detection:
malicious
Classification:
expl
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/1403685
Signature
Sigma detected: Potentially Suspicious PowerShell Child Processes
Suspicious execution chain found
Suspicious powershell command line found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Windows shortcut file (LNK) starts blacklisted processes
Wscript starts Powershell (via cmd or directly)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1403685 Sample: 1040doc_pdf.lnk Startdate: 05/03/2024 Architecture: WINDOWS Score: 68 28 Windows shortcut file (LNK) starts blacklisted processes 2->28 30 Sigma detected: Potentially Suspicious PowerShell Child Processes 2->30 8 wscript.exe 1 2->8         started        11 svchost.exe 1 1 2->11         started        process3 dnsIp4 32 Windows shortcut file (LNK) starts blacklisted processes 8->32 34 Suspicious powershell command line found 8->34 36 Wscript starts Powershell (via cmd or directly) 8->36 38 2 other signatures 8->38 14 powershell.exe 21 8->14         started        26 127.0.0.1 unknown unknown 11->26 signatures5 process6 signatures7 40 Windows shortcut file (LNK) starts blacklisted processes 14->40 17 powershell.exe 8 14->17         started        19 conhost.exe 14->19         started        process8 process9 21 mshta.exe 15 17->21         started        dnsIp10 24 168.100.8.242, 49700, 80 CLOUD9US United States 21->24
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ca388a52c69865829152ec89665ebdaa1b2a77dea74973352287c3a37fa1e206/
Threat name:
Shortcut.Dropper.Generic
Create hunting rule
Status:
Suspicious
First seen:
2024-03-05 20:37:05 UTC
File Type:
Binary
AV detection:
5 of 38 (13.16%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zi4iuuwgtbsyfeks5sewmxv5vinsu566u5exgnjcq7b2g75b4ida._file
Result
Malware family:
n/a
Score:
  10/10
Tags:
n/a
Link:
https://tria.ge/reports/240305-zd5b9shg34/
Behaviour
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks computer location settings
Blocklisted process makes network request
Malware Config
Dropper Extraction:
http://168.100.8.242/dc001/1040_document_pdf
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ca388a52c69865829152ec89665ebdaa1b2a77dea74973352287c3a37fa1e206

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:EXE_in_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies executable artefacts in shortcut (LNK) files.
Rule name:Long_RelativePath_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies shortcut (LNK) file with a long relative path. Might be used in an attempt to hide the path.
Rule name:PS_in_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies PowerShell artefacts in shortcut (LNK) files.
Rule name:Script_in_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies scripting artefacts in shortcut (LNK) files.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

DarkGate

Shortcut (lnk) lnk ca388a52c69865829152ec89665ebdaa1b2a77dea74973352287c3a37fa1e206

(this sample)

DarkGate

Visual Basic Script (vbs) vbs 4d86f191c4d7a5684116b671618669ec2bdd6bc08337fa2573c773386a14b2df

DarkGate

unknown bd53075ac414d8b388be01964a1975c2bf6727bd9d285218baea21b75981cb24

  
Dropping
SHA256 bd53075ac414d8b388be01964a1975c2bf6727bd9d285218baea21b75981cb24
  
Dropping
MD5 7326f7a44fd9a29c3d004dffd0367d85

Comments