MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7d300eb1d4889aa70e74b2be67a76d6494c3840ffc2fda597b3dac711f57a999. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	7d300eb1d4889aa70e74b2be67a76d6494c3840ffc2fda597b3dac711f57a999
SHA3-384 hash:	b6f93275ba5ec17a263b3c0bb2c2f7f6c49796b192df4c9bf032c35bcb167851bb252f939e10efa7dde22243e9285233
SHA1 hash:	fb524bd6e63f16ac697ba32a8a52d1b68335b5eb
MD5 hash:	9414ffe1ee77b42bee58ed16e23cae4f
humanhash:	moon-salami-mirror-twenty
File name:	PO-5712005082025 From Elhamd-pdf.vbs
Download:	download sample
Signature	DarkVisionRAT Alert Create hunting rule
File size:	713'129 bytes
First seen:	2025-05-08 14:32:26 UTC
Last seen:	Never
File type:	vbs
MIME type:	text/plain
ssdeep	12288:9wUuAHirJu6heHriMxZoG1bcE+Vxuz36S5+B8vazEsi/IASZlLga28tGCNPN1v3:H0heLiwZDQxSz3T+yvsBw6lUF+TBXv3
TLSH	T1EDE423700D567CFA8F7C09247A8B3E491E4F5A5F052E425AE2885AED13FB324CE225F5
Magika	vba
Reporter	abuse_ch
Tags:	DarkVisionRAT vbs

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

82

Origin country :

NL

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Generic-EXE.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Malware.30450.JsHeur.ExeObj.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.PUA.Base64EXE-2.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Malware.26270.JsHeur.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

91.7%

Link:

https://cyber-fortress.com/docs/result/index.php?id=681cc16791991ead82b63ae1

Tags:

dropper virus spawn

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-debug dropper evasive obfuscated obfuscated packed

Link:

https://www.filescan.io/uploads/681cc0aa0b64e174c41dfa19/reports/1d26ff9b-2d62-4b12-ae65-2c9e98bf0609/overview

Hybrid Analysis TrojanDropper/Agent.fg

Verdict:

Malicious

Labled as:

TrojanDropper/Agent.fg

Link:

https://www.hybrid-analysis.com/sample/7d300eb1d4889aa70e74b2be67a76d6494c3840ffc2fda597b3dac711f57a999

Joe Sandbox DarkVision Rat

Result

Threat name:

DarkVision Rat

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1684512

Signature

Benign windows process drops PE files

Connects to many ports of the same IP (likely port scanning)

Drops PE files to the document folder of the user

Found direct / indirect Syscall (likely to bypass EDR)

Found evasive API chain (may stop execution after checking mutex)

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Potential malicious VBS script found (has network functionality)

Queries the IP of a very long domain name

Sigma detected: WScript or CScript Dropper

Sigma detected: WScript or CScript Dropper - File

Suricata IDS alerts for network traffic

Uses dynamic DNS services

VBScript performs obfuscated calls to suspicious functions

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Windows Shell Script Host drops VBS files

Yara detected DarkVision Rat

Yara detected UAC Bypass using CMSTP

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7d300eb1d4889aa70e74b2be67a76d6494c3840ffc2fda597b3dac711f57a999/

ReversingLabs TitaniumCloud Script-WScript.Trojan.Donut

Threat name:

Script-WScript.Trojan.Donut

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-05-08 14:33:15 UTC

File Type:

Text (VBS)

AV detection:

11 of 37 (29.73%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=puya5mourcnkodtuwk7gpj3nmskmhbap7qx5uwl3hwwhch2xvgmq._file

Threatray donut_injector darkvisionrat

Verdict:

malicious

Label(s):

donut_injector

Alert

Create hunting rule

darkvisionrat

Alert

Create hunting rule

Similar samples:

error

DarkVisionRAT

Hatching Triage donutloader

Result

Malware family:

donutloader

Alert

Create hunting rule

Score:

  10/10

Tags:

family:donutloader loader persistence

Link:

https://tria.ge/reports/250508-rwycnsfk7t/

Behaviour

Modifies registry class

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Adds Run key to start application

Checks computer location settings

Executes dropped EXE

Detects DonutLoader

DonutLoader

Donutloader family

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/7d300eb1d4889aa70e74b2be67a76d6494c3840ffc2fda597b3dac711f57a999