MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 643c85416ff830ae12c09960d837f39e2605cab1dc4dbdcf5de3ea383b5e27cc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	643c85416ff830ae12c09960d837f39e2605cab1dc4dbdcf5de3ea383b5e27cc
SHA3-384 hash:	abf9706c41e05bb3cd675b42688eeb088e2941c0e7a62b2729acff4590ea38fa0bd27665d0e60904b7b279b4bb69f1ce
SHA1 hash:	5991e6f26e7c302708a4be73ffd56bca636009fc
MD5 hash:	1bac3ba2e3941dea6a6541961be54e80
humanhash:	muppet-oven-robin-twelve
File name:	ByI.vbs
Download:	download sample
Signature	DarkGate Alert Create hunting rule
File size:	15'290 bytes
First seen:	2023-09-27 14:30:52 UTC
Last seen:	Never
File type:	vbs
MIME type:	text/plain
ssdeep	24:6v/AE+kto64KBiHDmDHCWkqalW95VuF9/ITLBLdhXdHxjszxo+0Qg0:cn+kxJQyDHVxaM3cfI3RftuVvn
TLSH	T184625342918D03B5C5D90372AE434492CEC845387676E535EA38C02D3F9042CD2C86FB
Reporter	proxylife
Tags:	94-228-169-143 DarkGate vbs

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

167

Origin country :

DE

Vendor Threat Intelligence

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/451614/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Script.SNH-gen.22283.30803.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-vm

Link:

https://www.filescan.io/uploads/65143ca734be449f011a5f2d/reports/91d48b2b-cec7-43de-a144-41b2c52384f9/overview

Hybrid Analysis Valyria

Verdict:

Malicious

Labled as:

Valyria

Link:

https://www.hybrid-analysis.com/sample/643c85416ff830ae12c09960d837f39e2605cab1dc4dbdcf5de3ea383b5e27cc

Joe Sandbox DarkGate

Result

Threat name:

DarkGate

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1315324

Signature

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Found malware configuration

Leaks process information

Multi AV Scanner detection for submitted file

Potential malicious VBS script found (has network functionality)

Potential malicious VBS script found (suspicious strings)

Sigma detected: DarkGate

Snort IDS alert for network traffic

System process connects to network (likely due to code injection or exploit)

Uses known network protocols on non-standard ports

VBScript performs obfuscated calls to suspicious functions

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Yara detected DarkGate

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/643c85416ff830ae12c09960d837f39e2605cab1dc4dbdcf5de3ea383b5e27cc/

ReversingLabs TitaniumCloud Script-WScript.Trojan.DarkGate

Threat name:

Script-WScript.Trojan.DarkGate

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-09-27 14:31:05 UTC

File Type:

Binary

AV detection:

9 of 38 (23.68%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=mq6ikqlp7ayk4ewatfqnqn7ttytalsvr3rg33t254pvdqo26e7ga._file

Threatray malicious

Verdict:

malicious

Hatching Triage darkgate

Result

Malware family:

darkgate

Alert

Create hunting rule

Score:

  10/10

Tags:

family:darkgate stealer

Link:

https://tria.ge/reports/230927-rvpn5sbd3x/

Behaviour

Checks processor information in registry

Script User-Agent

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks computer location settings

Executes dropped EXE

Blocklisted process makes network request

Downloads MZ/PE file

DarkGate

Malware Config

C2 Extraction:

http://94.228.169.143

VMRay Malicious

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/643c85416ff8/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI DarkGate

Threat name:

DarkGate

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/643c85416ff830ae12c09960d837f39e2605cab1dc4dbdcf5de3ea383b5e27cc

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/451614/