MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 52a1722f0614e1c88473f4240ca1f5ac06d952159236014ef721598bc0889408. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DarkGate


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 52a1722f0614e1c88473f4240ca1f5ac06d952159236014ef721598bc0889408
SHA3-384 hash: ea2953d093675aa0795097488463f8460bb936afa64f762401443c0f28a1a201fbc079db8fa1edfa8e80f4a6d5058bf5
SHA1 hash: 6b2137d66246ad3c994a28141736bc707c88184b
MD5 hash: 1df0df7aa48965762597452d418db3f3
humanhash: muppet-stairway-kitten-spaghetti
File name:totdjhak.au3
Download: download sample
Signature DarkGate
Create hunting rule
File size:520'358 bytes
First seen:2023-11-09 14:55:48 UTC
Last seen:Never
File type:
MIME type:application/octet-stream
ssdeep 12288:VXKtYvL2LgNi7b02WtAO/Rvr5mZeQZ9o1BbKvsDA9Ul/:xKt/LgNoWtAOJvr5mZVSvA9k
TLSH T1C5B4ADB444A591154E7BFD083283EF57287721DDC9E3F7AAB993600E688D619BB80FC1
Reporter Xev
Tags:au3 DarkGate

Intelligence

File Origin
# of uploads :
1
# of downloads :
162
Origin country :
GR GR
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.AutoIT-86.UNOFFICIAL
Create hunting rule

Verdict:
No Threat
Threat level:
  2.5/10
Confidence:
100%
Tags:
masquerade
Link:
https://www.filescan.io/uploads/654cf30a641154c7e3f03802/reports/413860f4-b0ca-42a7-bdd5-c2cf3870e86a/overview
Verdict:
Malicious
Labled as:
Injector.Autoit
Link:
https://www.hybrid-analysis.com/sample/52a1722f0614e1c88473f4240ca1f5ac06d952159236014ef721598bc0889408
Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/52a1722f0614e1c88473f4240ca1f5ac06d952159236014ef721598bc0889408/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kkqxelygctq4rbdt6qsazipvvqdnsuqvsi3actxxefmyxqeisqea._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
DarkGate
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/52a1722f0614e1c88473f4240ca1f5ac06d952159236014ef721598bc0889408

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AutoIT_Script
Create hunting rule
Author:@bartblaze
Description:Identifies AutoIT script.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

DarkGate

Java Script (JS) js 16613e7c07681726ab577e6ac14114cb42691838fa3c6c4c1bef7dafa2c7c4a0

DarkGate

52a1722f0614e1c88473f4240ca1f5ac06d952159236014ef721598bc0889408

(this sample)

  
Dropped by
SHA256 16613e7c07681726ab577e6ac14114cb42691838fa3c6c4c1bef7dafa2c7c4a0
  
Dropped by
MD5 b428fd3b31d80dbdbbe4ee4949cfbe54

Comments