🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d2dcaec93d82105a85aa59a8c4bc3fb68cd84eefd9bac9caec917a6554ef63fe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DarkGate


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d2dcaec93d82105a85aa59a8c4bc3fb68cd84eefd9bac9caec917a6554ef63fe
SHA3-384 hash: 396cb0838895b2670b83049baca343ba22ea5c9b6299d7ab9fa535aba77ca1877a9130e6322ba82314397aa2f236fc5e
SHA1 hash: d015e659770dce7cf6587856fc108c7d67fd8536
MD5 hash: 5d04f41fc9f1b6c802f6927e2fa12882
humanhash: nineteen-dakota-muppet-fillet
File name:Navigating Future Changes 2023.zip
Download: download sample
Signature DarkGate
Create hunting rule
File size:260'285 bytes
First seen:2023-10-18 07:08:11 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 1536:6AIMFFdYMxAcEQDFXiAIMFFdYMxAcEQDHAIMFFdYMxAcEQD7AIMFFdYMxAcEQDtp:6EY8BFXiEY8BHEY8B7EY8BREY8BM
TLSH T140446276B2232D2A475751A3662E0207713A251FAC04707E787DA6DD6FED84C207FBB8
TrID 80.0% (.ZIP) ZIP compressed archive (4000/1)
20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter Anonymous
Tags:DarkGate zip


Avatar
Anonymous
dropped via external Teams chat invite

Intelligence

File Origin
# of uploads :
1
# of downloads :
163
Origin country :
CH CH
File Archive Information

This file archive contains 5 file(s), sorted by their relevance:

File name:Navigating_Our_Evolution_October_2023_Confidential.js
File size:51'806 bytes
SHA256 hash: 1706dccb08d8fa1a4e38ae118a4137c0ab4bb6b906eef24693a422a30b465e2d
MD5 hash: e65b29d3b1c48e5ca3d77588e6375382
MIME type:text/plain
Signature DarkGate
File name:Redefining_Our_Structural_Canvas_2023_Confidential.js
File size:51'321 bytes
SHA256 hash: ac61469d96805f9590d80397ed8fca735b718c000026ff5d99672c791d4707b7
MD5 hash: 6e0b712bbd5e1a3ee9eb2098cadf0a90
MIME type:text/plain
Signature DarkGate
File name:Embarking_on_Our_Renewed_Mission_and_Values_2023_Confidential.js
File size:51'121 bytes
SHA256 hash: c8c425368b40c30a09a8e4990e53a1df4c29493ad138287493da0d6f56f1dade
MD5 hash: c19568c51692a5b4dbfc29c02fafcf8d
MIME type:text/plain
Signature DarkGate
File name:Role_Directives_Effective_2023_Confidential.js
File size:53'075 bytes
SHA256 hash: 54464835989986ae3804a570f5e3b299db8cb2a19a47d6444b1d410ad51586ee
MD5 hash: 98a065c330d0e987786793a243f7f53e
MIME type:text/plain
Signature DarkGate
File name:Transition_Journey_2023_Confidential.js
File size:52'050 bytes
SHA256 hash: 412a2790effdc2b85bb83bdf1106fe2f2471df8dfd81df07084ba31371aa8887
MD5 hash: 83914282d9c9680c567121cc18dac066
MIME type:text/plain
Signature DarkGate
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.JS_Zip_1.UNOFFICIAL
Create hunting rule

Sanesecurity.Foxhole.JS_Zip_2.UNOFFICIAL
Create hunting rule

TwinWave.EvilJS.AXONestedFunction.20230731.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
75%
Tags:
hyena virus
Link:
https://www.filescan.io/uploads/652f8490a9645a41dd4ccd48/reports/c5da6074-390e-4b74-bc2d-8dae85b21e60/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/d2dcaec93d82105a85aa59a8c4bc3fb68cd84eefd9bac9caec917a6554ef63fe
Score:
1%
Verdict:
Benign
File Type:
Archive
Link:
https://malprob.io/report/d2dcaec93d82105a85aa59a8c4bc3fb68cd84eefd9bac9caec917a6554ef63fe
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d2dcaec93d82105a85aa59a8c4bc3fb68cd84eefd9bac9caec917a6554ef63fe/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2lok5sj5qiifvbnklgumjpb7w2gnqtxp3g5mtsxmsf5gkvhpmp7a._file
Result
Malware family:
darkgate
Create hunting rule
Score:
  10/10
Tags:
family:darkgate stealer
Link:
https://tria.ge/reports/231018-h4x77sde99/
Behaviour
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Checks computer location settings
Drops startup file
Executes dropped EXE
Blocklisted process makes network request
Downloads MZ/PE file
Suspicious use of NtCreateUserProcessOtherParentProcess
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_obfuscated_JS_obfuscatorio
Create hunting rule
Author:@imp0rtp3
Description:Detect JS obfuscation done by the js obfuscator (often malicious)
Reference:https://obfuscator.io

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments