MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1c1ae0d80ff0c58f81a7be7971f8dffa33a4a3ca77c257a4ed3815e485d2b17f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	1c1ae0d80ff0c58f81a7be7971f8dffa33a4a3ca77c257a4ed3815e485d2b17f
SHA3-384 hash:	5a4c4de7444704acb04f04bd2b85031ef83c81cf15da8287891503e18f7d65272db271c8e1d979d7eb17d0d0efd65f5f
SHA1 hash:	fc56b31262fc2b19131fea1fa232a086bba57de5
MD5 hash:	c44560a231cdc8e1c5d8fbffaa033fae
humanhash:	minnesota-fourteen-red-rugby
File name:	U7PM.vbs
Download:	download sample
Signature	DarkGate Alert Create hunting rule
File size:	2'559 bytes
First seen:	2023-09-28 10:14:35 UTC
Last seen:	Never
File type:	vbs
MIME type:	text/plain
ssdeep	48:bc1Vnl4nb1a4gRrDeJ1MHkiNJmm9g7gjbFhoidgH:bgBliRar6XG7jX9gkb8idg
TLSH	T1C751A69335181676D6B699F080211AC2FB5148343A76F7333E18E63A2A1146E8AE65FD
Reporter	JoulK
Tags:	DarkGate vbs

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

165

Origin country :

GB

Vendor Threat Intelligence

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/451752/

ClamAV Detected

Detection(s):

SecuriteInfo.com.HEUR.Trojan.Script.Generic.14015.15204.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

anti-vm

Link:

https://www.filescan.io/uploads/65155228988a26b6d971a41b/reports/bb62ebe8-525c-469f-a13a-6e68f4277192/overview

Hybrid Analysis Trojan.Script

Verdict:

Suspicious

Labled as:

Trojan.Script

Link:

https://www.hybrid-analysis.com/sample/1c1ae0d80ff0c58f81a7be7971f8dffa33a4a3ca77c257a4ed3815e485d2b17f

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

troj.evad

Score:

76 / 100

Link:

https://www.joesandbox.com/analysis/1315765

Signature

Antivirus detection for URL or domain

Leaks process information

Potential malicious VBS script found (has network functionality)

Potential malicious VBS script found (suspicious strings)

System process connects to network (likely due to code injection or exploit)

Uses known network protocols on non-standard ports

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1c1ae0d80ff0c58f81a7be7971f8dffa33a4a3ca77c257a4ed3815e485d2b17f/

ReversingLabs TitaniumCloud Script-WScript.Trojan.Darkgate

Threat name:

Script-WScript.Trojan.Darkgate

Alert

Create hunting rule

Status:

Suspicious

First seen:

2023-09-28 10:15:06 UTC

File Type:

Binary

AV detection:

8 of 24 (33.33%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=dqnobwap6dcy7anhxz4xd6g77iz2ji6ko7bfpjhnhak6jboswf7q._file

Threatray unknown

Verdict:

unknown

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

n/a

Link:

https://tria.ge/reports/230928-l98snsbh69/

Behaviour

Script User-Agent

Blocklisted process makes network request

VMRay Malicious

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/1c1ae0d80ff0/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/1c1ae0d80ff0c58f81a7be7971f8dffa33a4a3ca77c257a4ed3815e485d2b17f

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/451752/