MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 500e47c16f5eb83699e1837a2125a1b7f9c0352eef354c19ef919563e9ae71aa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	500e47c16f5eb83699e1837a2125a1b7f9c0352eef354c19ef919563e9ae71aa
SHA3-384 hash:	fe484dff16a8c6026a54db04bd42be4339190599a878571f7a0d0d5a98ad1b29c349003003272dbee256abbc943dd6c6
SHA1 hash:	206167f8be56ec36f3a60c9412b47240f57155cd
MD5 hash:	1040b010d6b41f61297b3a00cebffcd4
humanhash:	island-moon-pasta-berlin
File name:	5c633ac0c18192e78c4ec6d04db62ce26864915906a32bcd8daf62c2
Download:	download sample
Signature	DarkGate Alert Create hunting rule
File size:	10'032 bytes
First seen:	2023-10-14 02:08:29 UTC
Last seen:	Never
File type:	vbs
MIME type:	text/plain
ssdeep	192:fpPMu0Cp4EmpXUHg4KR/oNQsKTUm1LF3K7w:fp0zE0ig4KR/aQsKwmv3K7w
TLSH	T1B122AC52FD0B8E74E056DE8A2D07A0D2C9320402FA44A5D4BB9CF7CD978F72994FE660
Reporter	r3dbU7z
Tags:	DarkGate stager vbs

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

169

Origin country :

RU

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Script.SNH-gen.17113.31685.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO No Threat

Verdict:

No Threat

Threat level:

  2.5/10

Confidence:

100%

Tags:

control cscript lolbin

Link:

https://www.filescan.io/uploads/6529f83f422e14c65a8f6e21/reports/97b67a04-2a3b-40c2-8968-608f83b2d2a8/overview

Hybrid Analysis Trojan.VBS.DarkGate

Verdict:

Suspicious

Labled as:

Trojan.VBS.DarkGate

Link:

https://www.hybrid-analysis.com/sample/500e47c16f5eb83699e1837a2125a1b7f9c0352eef354c19ef919563e9ae71aa

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

72 / 100

Link:

https://www.joesandbox.com/analysis/1325693

Signature

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Potential malicious VBS script found (suspicious strings)

VBScript performs obfuscated calls to suspicious functions

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

1%

Verdict:

Benign

File Type:

ASCII

Link:

https://malprob.io/report/500e47c16f5eb83699e1837a2125a1b7f9c0352eef354c19ef919563e9ae71aa

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/500e47c16f5eb83699e1837a2125a1b7f9c0352eef354c19ef919563e9ae71aa/

ReversingLabs TitaniumCloud Win32.Dropper.Generic

Threat name:

Win32.Dropper.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2023-10-14 03:01:44 UTC

AV detection:

1 of 38 (2.63%)

Threat level:

  3/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=kahepqlpl24dngpbqn5ccjnbw744anjo542uygppsgkwh2noogva._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI DarkGate

Threat name:

DarkGate

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/500e47c16f5eb83699e1837a2125a1b7f9c0352eef354c19ef919563e9ae71aa