MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 46c5ed90e3d6b8bc85ae369aa87ba75a12eed6a7cfa8edeb497e5ec7f7c75d9e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

DarkGate

Vendor detections: 4

Intelligence 4 IOCs YARA 2 File information Comments

SHA256 hash:	46c5ed90e3d6b8bc85ae369aa87ba75a12eed6a7cfa8edeb497e5ec7f7c75d9e
SHA3-384 hash:	a3f053bcd7bfab027c462fba065934713f235e1470c3ee5ee3f8b10e95a824c30d33eebd1cbd34ab277b954a43b349d9
SHA1 hash:	b78bc11afacf9cfcaade0e200a344c4602f2053d
MD5 hash:	e1803b01e3f187355dbeb87a0c91b76c
humanhash:	south-oven-vermont-high
File name:	script.au3
Download:	download sample
Signature	DarkGate Create hunting rule
File size:	480'884 bytes
First seen:	2024-01-24 17:59:08 UTC
Last seen:	Never
File type:
MIME type:	application/octet-stream
ssdeep	12288:ZkvyTm8GvC4sSTNJhtXVX9Asbbyhz2mfBLa7EVRcJu4pLrFpUGn6KG5N0iAe+:AsJGvBtTT1OBLZvu6N0a+
TLSH	T1F1A4AFFED415C00154DCECAAFFB299DE03B739EF8C92661E5E603915BAE055921F803A
Reporter	e24111111111111
Tags:	au3 DarkGate

Intelligence

File Origin

# of uploads :

# of downloads :

194

Origin country :

Vendor Threat Intelligence

Verdict:

No Threat

Threat level:

2.5/10

Confidence:

100%

Tags:

masquerade

Link:

https://www.filescan.io/uploads/65b15026eda27a7ac10110dc/reports/fd14e827-79a1-47e3-a997-53a5023f4b2f/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/46c5ed90e3d6b8bc85ae369aa87ba75a12eed6a7cfa8edeb497e5ec7f7c75d9e

Result

Verdict:

MALICIOUS

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/46c5ed90e3d6b8bc85ae369aa87ba75a12eed6a7cfa8edeb497e5ec7f7c75d9e/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=i3c63ehd224lzbnog2nkq65hlijo5vvhz6uo322jpzpmp56hlwpa._file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.05

Link:

https://yomi.yoroi.company/submissions/46c5ed90e3d6b8bc85ae369aa87ba75a12eed6a7cfa8edeb497e5ec7f7c75d9e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AutoIT_Script Create hunting rule
Author:	@bartblaze
Description:	Identifies AutoIT script. This rule by itself does NOT necessarily mean the detected file is malicious.

Rule name:	SUSP_XORed_MSDOS_Stub_Message Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious XORed MSDOS stub message
Reference:	https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings