MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 78173877885f7d0b28cb13b16a034b4849ccc2c3f2b7a92ed8ed71e2956248c8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	78173877885f7d0b28cb13b16a034b4849ccc2c3f2b7a92ed8ed71e2956248c8
SHA3-384 hash:	0ec44d32085195525901a8d14cb640fb0bcac63a22d992f77fe3f189844a7bf8a648e0420aab274a8646004bf1c252ac
SHA1 hash:	6cd29a7130cc56b28e84bb92ff847dbff7b9880e
MD5 hash:	998323d209e25f000ed01a0e7cf2f4ea
humanhash:	maine-comet-fish-speaker
File name:	Report-15.vbs
Download:	download sample
Signature	DarkGate Alert Create hunting rule
File size:	17'225 bytes
First seen:	2023-10-10 16:56:30 UTC
Last seen:	Never
File type:	vbs
MIME type:	text/plain
ssdeep	384:SzE0ig4KR/aQsKHWMnkf+cTPgKekvj27vmJYs:AJHHXkfNEKekvq7eJz
TLSH	T1EA723F52ED075D38E047DAE7694F50F1C43200A3B654A1A4BE8CF6E95B83725B8FE262
Reporter	malwarelabnet
Tags:	DarkGate vbs

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

153

Origin country :

CA

Vendor Threat Intelligence

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/452939/

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/65258261e509ddb6cd202d25/reports/e29510c4-319d-40c3-beb8-23def99fc9d4/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/78173877885f7d0b28cb13b16a034b4849ccc2c3f2b7a92ed8ed71e2956248c8

Joe Sandbox DarkGate, MailPassView

Result

Threat name:

DarkGate, MailPassView

Alert

Create hunting rule

Detection:

malicious

Classification:

rans.troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1323113

Signature

C2 URLs / IPs found in malware configuration

Contains functionality to modify clipboard data

Deletes shadow drive data (may be related to ransomware)

Found malware configuration

Potential malicious VBS script found (suspicious strings)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses known network protocols on non-standard ports

VBScript performs obfuscated calls to suspicious functions

Yara detected DarkGate

Yara detected MailPassView

Yara detected WebBrowserPassView password recovery tool

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/78173877885f7d0b28cb13b16a034b4849ccc2c3f2b7a92ed8ed71e2956248c8/

ReversingLabs TitaniumCloud Script-WScript.Trojan.Tnega

Threat name:

Script-WScript.Trojan.Tnega

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-10-10 16:57:08 UTC

File Type:

Text (VBS)

AV detection:

5 of 21 (23.81%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=paltq54il56qwkglcoywua2ljbe4zqwd6k32slwy5vy6fflcjdea._file

Threatray unknown

Verdict:

unknown

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

n/a

Link:

https://tria.ge/reports/231010-vf9bsaef5z/

Behaviour

Checks processor information in registry

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks computer location settings

Executes dropped EXE

Blocklisted process makes network request

Downloads MZ/PE file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/452939/