🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d295e026fd1538e2761916473194c08f83faa4935ebbc8d54ef2643786624c13. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DarkGate


Vendor detections: 5


Intelligence 5 IOCs YARA 40 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d295e026fd1538e2761916473194c08f83faa4935ebbc8d54ef2643786624c13
SHA3-384 hash: d08db7bf9cec4488dc991c9bdd543a6772a7883197a930f0f9e64ef3adf8fc0824d6440737b51b9258cdf42107753576
SHA1 hash: 184eee91731f97918ddae45856311de9b0a97884
MD5 hash: 659c1c18bf04a8e467ebb47f8fbcd5e0
humanhash: princess-steak-queen-glucose
File name:Confidential Significant Company Changes.zip
Download: download sample
Signature DarkGate
Create hunting rule
File size:4'846 bytes
First seen:2023-09-21 16:59:44 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 96:uwbBlzeCRHkyYQeHdKHPzueXBlhG1G17tQiJ6o7/7VLvQwvYV:HB1PkorXBlGGzrTFQAYV
TLSH T1ABA12AD2D7C70D80C18B527143EB2ECAAB611B4A1472D02B2CE5D96B49C788647F5A7A
TrID 80.0% (.ZIP) ZIP compressed archive (4000/1)
20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter Debarghaya
Tags:DarkGate zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
162
Origin country :
AU AU
File Archive Information

This file archive contains 5 file(s), sorted by their relevance:

File name:Revamped Organizational Structure.pdf.lnk
File size:2'115 bytes
SHA256 hash: 884a7652d9c4a9ec5c30f8b2b6fe5d713ee786699197f3a2e99d489a0566d8f9
MD5 hash: 9cc6bd40b5e900a8ae7d05cdbf6ced7b
MIME type:application/octet-stream
Signature DarkGate
File name:Company Transformations.pdf.lnk
File size:2'108 bytes
SHA256 hash: 2b31d24b4040c4e57b0763eb38c387f3d98411780e9e3580a6f1933e1bcfa2df
MD5 hash: 1f5ddc00ded03b107ed1306f49592188
MIME type:application/octet-stream
Signature DarkGate
File name:Fresh Mission and Core Values.pdf.lnk
File size:2'118 bytes
SHA256 hash: e69a776549f8c3e68d4729dde9a1679f633d230bca21b6a2144dfd5599269d6e
MD5 hash: cea0885964c5c18fd7410ca82e0da52e
MIME type:application/octet-stream
Signature DarkGate
File name:Employees Affected by Transition.pdf.lnk
File size:2'131 bytes
SHA256 hash: c71656ae097836b8e2b5012abacb9f8ef1f9efdaf2e15f054042efe329194c76
MD5 hash: 53c61b0df8d77c23837ac1c96a45fff8
MIME type:application/octet-stream
Signature DarkGate
File name:Position Guidelines.pdf.lnk
File size:2'152 bytes
SHA256 hash: 05820445ba75f9b322c13c93935f20785bcd1219e2db794b9155da8d867f5a11
MD5 hash: 4be13bf63e30e1c73d4c80b05a9b739b
MIME type:application/octet-stream
Signature DarkGate
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Lnk_Zip_1.UNOFFICIAL
Create hunting rule

Sanesecurity.Foxhole.Zip_pdf.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.27118.LnkHeur.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.26471.PshHeur.UNOFFICIAL
Create hunting rule

TwinWave.EvilLNK.HTTPDottedQuadPolicykill.20220908.UNOFFICIAL
Create hunting rule

TwinWave.EvilLNK.CerealKiller.808fa09e.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Zip.LNK-1.UNOFFICIAL
Create hunting rule

Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
89%
Tags:
cmd evasive lolbin masquerade ping
Link:
https://www.filescan.io/uploads/650c76931edabd99829e2a79/reports/e8469784-0924-4094-aa7d-5a614a4baee5/overview
Verdict:
Malicious
Labled as:
Trojan.WinLNK.Agent
Link:
https://www.hybrid-analysis.com/sample/d295e026fd1538e2761916473194c08f83faa4935ebbc8d54ef2643786624c13
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d295e026fd1538e2761916473194c08f83faa4935ebbc8d54ef2643786624c13/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2kk6ajx5cu4oe5qzczdtdfgar6b7vjetl254rvko6jsdpbtcjqjq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d295e026fd1538e2761916473194c08f83faa4935ebbc8d54ef2643786624c13

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Download_in_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies download artefacts in shortcut (LNK) files.
Rule name:Execution_in_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies execution artefacts in shortcut (LNK) files.
Rule name:EXE_in_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies executable artefacts in shortcut (LNK) files.
Rule name:LNK_sospechosos
Create hunting rule
Author:Germán Fernández
Description:Detecta archivos .lnk sospechosos
Rule name:Long_RelativePath_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies shortcut (LNK) file with a long relative path. Might be used in an attempt to hide the path.
Rule name:PDF_in_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies Adobe Acrobat artefacts in shortcut (LNK) files.
Rule name:Script_in_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies scripting artefacts in shortcut (LNK) files.
Rule name:SUSP_LNK_CMD
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects the reference to cmd.exe inside an lnk file, which is suspicious

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments