MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5cb9876681f78d3ee8a01a5aaa5d38b05ec81edc48b09e3865b75c49a2187831. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	5cb9876681f78d3ee8a01a5aaa5d38b05ec81edc48b09e3865b75c49a2187831
SHA3-384 hash:	1dd33043a5808574588c0e0f7406ada8d4dfe2692961bc6376cb9adfbdfbf8a9fa7cb98c5312388f067c3af254e97007
SHA1 hash:	e3931fca0386f00e1c246039c3491b686e5d8354
MD5 hash:	29552b793e8d97538afff1aaf566a625
humanhash:	september-lemon-artist-don
File name:	QB-04_02_24_inv765541BA.vbs
Download:	download sample
Signature	DarkGate Alert Create hunting rule
File size:	8'262 bytes
First seen:	2024-04-02 16:01:36 UTC
Last seen:	Never
File type:	vbs
MIME type:	text/plain
ssdeep	192:YMg119gkCtL3IqSPN3QzGNzUoNJnN/Y99957:jy19gR3IquNgzG2oNl4
TLSH	T16A02E203BD578434F0341C175D23642EE750111363A1FBE976ADC39B8B2ADAAECB6D68
Reporter	k3dg3___
Tags:	admin888 DarkGate vbs

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

166

Origin country :

US

Vendor Threat Intelligence

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

cscript lolbin powershell

Link:

https://www.filescan.io/uploads/660c2c0015f64ac503502b38/reports/8135738c-d77d-4908-9767-9143965f4c6f/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/5cb9876681f78d3ee8a01a5aaa5d38b05ec81edc48b09e3865b75c49a2187831

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Joe Sandbox DarkGate, MailPassView

Result

Threat name:

DarkGate, MailPassView

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1418898

Signature

Multi AV Scanner detection for dropped file

Potential malicious VBS script found (suspicious strings)

Powershell drops PE file

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

VBScript performs obfuscated calls to suspicious functions

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Yara detected DarkGate

Yara detected MailPassView

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

3%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/5cb9876681f78d3ee8a01a5aaa5d38b05ec81edc48b09e3865b75c49a2187831

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5cb9876681f78d3ee8a01a5aaa5d38b05ec81edc48b09e3865b75c49a2187831/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ls4yozub66gt52fadjnkuxjywbpmqhw4jcyj4odfw5oetiqypayq._file

Threatray unknown

Verdict:

unknown

Hatching Triage darkgate

Result

Malware family:

darkgate

Alert

Create hunting rule

Score:

  10/10

Tags:

family:darkgate botnet:admin888 stealer

Link:

https://tria.ge/reports/240402-tgryfseg8y/

Behaviour

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Views/modifies file attributes

Enumerates physical storage devices

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Blocklisted process makes network request

DarkGate

Detect DarkGate stealer

Malware Config

C2 Extraction:

31yc.com

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/5cb9876681f78d3ee8a01a5aaa5d38b05ec81edc48b09e3865b75c49a2187831