MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3d31b03635eb488ca318f67e3555305a25dc260fe6f5e059e4675b1ae7e026a4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

DarkGate

Vendor detections: 5

Intelligence 5 IOCs YARA 12 File information Comments

SHA256 hash:	3d31b03635eb488ca318f67e3555305a25dc260fe6f5e059e4675b1ae7e026a4
SHA3-384 hash:	9abdfce2b4548defd8ba7d66f986d530c37679b5bd268cff749d448dbbaaae2dbd6f6db09f82cbcda38bdc8cc374cff9
SHA1 hash:	ade37aba6a17e8eb98beed5c4d590e4e93bd0e73
MD5 hash:	5c7f3935a8ff564e33d8674d4e716a6a
humanhash:	mockingbird-echo-lion-five
File name:	yutighh.zip
Download:	download sample
Signature	DarkGate Create hunting rule
File size:	802'739 bytes
First seen:	2024-12-14 20:42:43 UTC
Last seen:	2024-12-16 13:01:14 UTC
File type:	zip
MIME type:	application/zip
ssdeep	12288:3Dkq0C/sFxWWeu3OC45qZmLJVX2MJn0WVE17eGlEyU4PDNBk9LZ5eWLmHlle:39J/AMcR4oZm3h0d16K3/8eWLmFle
TLSH	T1D00533284E953DFC5774BA12899E408CD23AB24850FCA8DF9F906C39D80F2BD97D345A
Magika	zip
Reporter	NDA0E
Tags:	154-216-16-83 DarkGate zip

Intelligence

File Origin

# of uploads :

# of downloads :

776

Origin country :

File Archive Information

This file archive contains 2 file(s), sorted by their relevance:

File name:	script.a3x
File size:	596'624 bytes
SHA256 hash:	f2f20d4232da128f7dedc0edf844a92a3e3f6c8a997fab47777a396b0b4a5f53
MD5 hash:	3e44fef10a982713adb597df2b72c27f
MIME type:	application/octet-stream
Signature	DarkGate

File name:	Autoit3.exe
File size:	893'608 bytes
SHA256 hash:	237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
MD5 hash:	c56b5f0201a3b3de53e561fe76912bfd
MIME type:	application/x-dosexec
Signature	DarkGate

Vendor Threat Intelligence

Verdict:

Clean

Score:

89.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=675def9e8fb73f13afc74d83

Tags:

autoit emotet

Result

Verdict:

Suspicious

File Type:

PE File

Link:

https://app.docguard.net/3d31b03635eb488ca318f67e3555305a25dc260fe6f5e059e4675b1ae7e026a4/results/dashboard

Behaviour

BlacklistAPI detected

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

adaptive-context autoit fingerprint keylogger microsoft_visual_cc

Link:

https://www.filescan.io/uploads/675dedd608f166f50c9dbdcc/reports/68aadbf9-797d-4976-ab8a-9ddd8a215579/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/3d31b03635eb488ca318f67e3555305a25dc260fe6f5e059e4675b1ae7e026a4

Score:

94%

Verdict:

Malware

File Type:

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AutoIT_Compiled Create hunting rule
Author:	@bartblaze
Description:	Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.

Rule name:	AutoIT_Script Create hunting rule
Author:	@bartblaze
Description:	Identifies AutoIT script. This rule by itself does NOT necessarily mean the detected file is malicious.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	PE_Potentially_Signed_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	RansomPyShield_Antiransomware Create hunting rule
Author:	XiAnzheng
Description:	Check for Suspicious String and Import combination that Ransomware mostly abuse(can create FP)

Rule name:	SUSP_XORed_MSDOS_Stub_Message Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious XORed MSDOS stub message
Reference:	https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)