MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 885eae8e4d2788a7c54f4123cbf84b4e897082f8388a7b3f3c2bace9f9419e13. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	885eae8e4d2788a7c54f4123cbf84b4e897082f8388a7b3f3c2bace9f9419e13
SHA3-384 hash:	972944bad154a6feae8f7049a839c554b37162d80fd9a8b216a8760b52ab33acb9b8ce6e4b5ea8c84f72ed0e88c3768b
SHA1 hash:	5b2644004b27a4b39502ad0d4a0193d0124588cb
MD5 hash:	4ff404ceede30c0ca73b97e26f20dfa8
humanhash:	princess-thirteen-lake-island
File name:	quickbook_April-2024.vbs
Download:	download sample
Signature	DarkGate Alert Create hunting rule
File size:	8'111 bytes
First seen:	2024-04-02 16:12:56 UTC
Last seen:	Never
File type:	vbs
MIME type:	text/plain
ssdeep	192:YMg119gkCtL3IqSPN3QzGNzUoNJnN/Y999E6:jy19gR3IquNgzG2oNla
TLSH	T1D0F1F143BD578434F0341C075D23642EE750111363A1BBE976ADC39B8B3ADAAECB6D68
Reporter	k3dg3___
Tags:	admin888 DarkGate vbs

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

211

Origin country :

US

Vendor Threat Intelligence

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

cscript lolbin powershell

Link:

https://www.filescan.io/uploads/660c2e966ffbb8b1692dff17/reports/cdea8b2f-8adf-4c34-8b0d-d7a1af6d9d12/overview

Hybrid Analysis VBS/DwnLdr

Verdict:

Suspicious

Labled as:

VBS/DwnLdr

Link:

https://www.hybrid-analysis.com/sample/885eae8e4d2788a7c54f4123cbf84b4e897082f8388a7b3f3c2bace9f9419e13

Joe Sandbox DarkGate, MailPassView

Result

Threat name:

DarkGate, MailPassView

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

92 / 100

Link:

https://www.joesandbox.com/analysis/1418902

Signature

Potential malicious VBS script found (suspicious strings)

Powershell drops PE file

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

VBScript performs obfuscated calls to suspicious functions

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Yara detected DarkGate

Yara detected MailPassView

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

3%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/885eae8e4d2788a7c54f4123cbf84b4e897082f8388a7b3f3c2bace9f9419e13

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/885eae8e4d2788a7c54f4123cbf84b4e897082f8388a7b3f3c2bace9f9419e13/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=rbpk5dsne6ekprkpier4x6clj2exbaxyhcfhwpz4fowot6kbtyjq._file

Threatray unknown

Verdict:

unknown

Hatching Triage darkgate

Result

Malware family:

darkgate

Alert

Create hunting rule

Score:

  10/10

Tags:

family:darkgate botnet:admin888 stealer

Link:

https://tria.ge/reports/240402-tn3njafa4x/

Behaviour

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Views/modifies file attributes

Enumerates physical storage devices

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Blocklisted process makes network request

DarkGate

Detect DarkGate stealer

Malware Config

C2 Extraction:

31yc.com

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/885eae8e4d2788a7c54f4123cbf84b4e897082f8388a7b3f3c2bace9f9419e13