MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 78b3702f5c0f7efdf4598a2284cf3c7b3b51a6ae93a001029290bcc6a97bdc0a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

DarkGate

Vendor detections: 5

Intelligence 5 IOCs YARA 3 File information Comments

SHA256 hash:	78b3702f5c0f7efdf4598a2284cf3c7b3b51a6ae93a001029290bcc6a97bdc0a
SHA3-384 hash:	8d79e8e2a3f7e072b9050a904dcb2945a2826e062e019d645152dc376e277e8aef8747e82f7cf6de309e2d6e2003c07e
SHA1 hash:	c407d97bdb9bf1cd461fa40c66f261e3f92dd602
MD5 hash:	b395d416df27709427c17c04725a4c45
humanhash:	fillet-arkansas-gee-london
File name:	script.au3
Download:	download sample
Signature	DarkGate Create hunting rule
File size:	477'940 bytes
First seen:	2024-01-24 17:27:32 UTC
Last seen:	Never
File type:
MIME type:	application/octet-stream
ssdeep	6144:yl0LkFJuM13fT30V6CCaMAUrQpgW2FMytvuUgkTWKVJzT8enJWom+6jv+c02jIfR:gVPu2L5alEWI1mZObi67IVPy7
TLSH	T1DAA47D87484B43A885FEB31C56BD89A98D18D25B823190C7CE6774C6BC5FEB87CE6D01
Reporter	e24111111111111
Tags:	au3 DarkGate

Intelligence

File Origin

# of uploads :

# of downloads :

169

Origin country :

Vendor Threat Intelligence

Verdict:

No Threat

Threat level:

2.5/10

Confidence:

100%

Tags:

masquerade

Link:

https://www.filescan.io/uploads/65b148a5d7517a546c676254/reports/068fa709-fa11-4a3a-8b21-0f5f9edd2541/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/78b3702f5c0f7efdf4598a2284cf3c7b3b51a6ae93a001029290bcc6a97bdc0a

Result

Verdict:

MALICIOUS

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/78b3702f5c0f7efdf4598a2284cf3c7b3b51a6ae93a001029290bcc6a97bdc0a/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=pczxal24b57p35czririjtz4pm5vdjvosoqacaussc6mnkl33qfa._file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

DarkGate

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/78b3702f5c0f7efdf4598a2284cf3c7b3b51a6ae93a001029290bcc6a97bdc0a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AutoIT_Script Create hunting rule
Author:	@bartblaze
Description:	Identifies AutoIT script. This rule by itself does NOT necessarily mean the detected file is malicious.

Rule name:	BitcoinAddress Create hunting rule
Author:	Didier Stevens (@DidierStevens)
Description:	Contains a valid Bitcoin address

Rule name:	SUSP_XORed_MSDOS_Stub_Message Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious XORed MSDOS stub message
Reference:	https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings