MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3a586493131b5a1784e7da751f12fd992bc41f300a28dcc5021d2127d33cb8bc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	3a586493131b5a1784e7da751f12fd992bc41f300a28dcc5021d2127d33cb8bc
SHA3-384 hash:	d174366a4387326f959843fdafe5999756b83e5b5e09630dbbc08472fd9ecc6baac62e5c81d9afd24981f3371f5a0683
SHA1 hash:	c4af665bb0e180bb21b0d598902692d0a439f037
MD5 hash:	5f70fb2cdf26249758373482e2d296a0
humanhash:	spaghetti-orange-xray-west
File name:	e664858e8b8ff1ac08f6dd812a68d65d05a704262fa13862538c3c45
Download:	download sample
Signature	DarkGate Alert Create hunting rule
File size:	158'256 bytes
First seen:	2023-10-15 19:33:42 UTC
Last seen:	Never
File type:	vbs
MIME type:	text/plain
ssdeep	3072:By+J+gqybZnIsUVsXv0ubCWL/CFGZtJqj5MvQV1:BTWsL/I9
TLSH	T151F31A0BF948122B49C34696F80775B3AD7DC421A74D22E1ECAED21877CB4ED826E5F4
Reporter	r3dbU7z
Tags:	DarkGate vbs

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

232

Origin country :

RU

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Script.SNH-gen.27430.11062.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/652c3eaad9aa13270183bd13/reports/7db178f6-abfc-48ea-b601-87fec47ff5ec/overview

Hybrid Analysis Trojan.Script

Verdict:

Suspicious

Labled as:

Trojan.Script

Link:

https://www.hybrid-analysis.com/sample/3a586493131b5a1784e7da751f12fd992bc41f300a28dcc5021d2127d33cb8bc

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

troj.evad

Score:

80 / 100

Link:

https://www.joesandbox.com/analysis/1326219

Signature

Antivirus detection for URL or domain

Potential malicious VBS script found (has network functionality)

Potential malicious VBS script found (suspicious strings)

System process connects to network (likely due to code injection or exploit)

Uses known network protocols on non-standard ports

VBScript performs obfuscated calls to suspicious functions

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

3%

Verdict:

Benign

File Type:

ASCII

Link:

https://malprob.io/report/3a586493131b5a1784e7da751f12fd992bc41f300a28dcc5021d2127d33cb8bc

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3a586493131b5a1784e7da751f12fd992bc41f300a28dcc5021d2127d33cb8bc/

ReversingLabs TitaniumCloud Win32.Trojan.Generic

Threat name:

Win32.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2023-10-15 19:34:04 UTC

File Type:

Text

AV detection:

1 of 38 (2.63%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=hjmgjeytdnnbpbhh3j2r6ex5tev4ihzqbiunzricduqspuz4xc6a._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/3a586493131b5a1784e7da751f12fd992bc41f300a28dcc5021d2127d33cb8bc