🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a7312f01db21efd84be0a4e596fefb6ebbc388655ab19a642bf44360f1409382. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DarkGate


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a7312f01db21efd84be0a4e596fefb6ebbc388655ab19a642bf44360f1409382
SHA3-384 hash: 69686a79dc4b064ffad3e1be58820c1536c90feaab63a3c72cd84e3c9d4c381b27ecc944b74dd8671f676fb1126dd531
SHA1 hash: 878ecd062105626c480471cb53ab2a310f4d5dce
MD5 hash: 9120c82b0920b9db39894107b5494ccd
humanhash: lake-blossom-magnesium-helium
File name:L9T.vbs
Download: download sample
Signature DarkGate
Create hunting rule
File size:13'727 bytes
First seen:2023-09-25 12:32:21 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 48:8Uw2oMnZ78UT+iDuYwUBWDHVxaMnyc2pU:8MZ78Wrut3arca
TLSH T1945254074AC88142C0F58732628A619FEAC581756736C579396ED43CAB90CA995B12E7
Reporter JAMESWT_WT
Tags:94-228-169-143 DarkGate vbs

Intelligence

File Origin
# of uploads :
1
# of downloads :
153
Origin country :
IT IT
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/451084/
Detection(s):
SecuriteInfo.com.Script.SNH-gen.30938.20225.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
57%
Tags:
anti-vm
Link:
https://www.filescan.io/uploads/65117e0332ffdb7a7a136d47/reports/25163ed4-0dda-4896-bea6-f984de7d0a17/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/a7312f01db21efd84be0a4e596fefb6ebbc388655ab19a642bf44360f1409382
Result
Threat name:
DarkGate
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1313881
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Leaks process information
Multi AV Scanner detection for domain / URL
Potential malicious VBS script found (has network functionality)
Potential malicious VBS script found (suspicious strings)
Sigma detected: DarkGate
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Uses known network protocols on non-standard ports
VBScript performs obfuscated calls to suspicious functions
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Yara detected DarkGate
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1313881 Sample: L9T.vbs Startdate: 25/09/2023 Architecture: WINDOWS Score: 100 28 tse1.mm.bing.net 2->28 32 Snort IDS alert for network traffic 2->32 34 Multi AV Scanner detection for domain / URL 2->34 36 Found malware configuration 2->36 38 8 other signatures 2->38 8 wscript.exe 1 2->8         started        signatures3 process4 dnsIp5 30 94.228.169.143, 2351, 49762, 49763 SSERVICE-ASRU Russian Federation 8->30 40 System process connects to network (likely due to code injection or exploit) 8->40 42 VBScript performs obfuscated calls to suspicious functions 8->42 44 Windows Scripting host queries suspicious COM object (likely to drop second stage) 8->44 12 cmd.exe 3 8->12         started        signatures6 process7 file8 24 C:\vjik\vjik.exe, PE32+ 12->24 dropped 15 vjik.exe 2 12->15         started        18 Autoit3.exe 12->18         started        20 conhost.exe 12->20         started        22 vjik.exe 2 12->22         started        process9 file10 26 C:\vjik\Autoit3.exe, PE32 15->26 dropped
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a7312f01db21efd84be0a4e596fefb6ebbc388655ab19a642bf44360f1409382/
Threat name:
Script-WScript.Trojan.DarkGate
Create hunting rule
Status:
Malicious
First seen:
2023-09-25 12:31:36 UTC
File Type:
Binary
AV detection:
6 of 22 (27.27%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=u4ys6ao3ehx5qs7autszn7x3n254hcdflkyzuzbl6rbwb4kasoba._file
Result
Malware family:
darkgate
Create hunting rule
Score:
  10/10
Tags:
family:darkgate stealer
Link:
https://tria.ge/reports/230925-pq7m2seh2s/
Behaviour
Checks processor information in registry
Script User-Agent
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks computer location settings
Executes dropped EXE
Blocklisted process makes network request
Downloads MZ/PE file
DarkGate
Malware Config
C2 Extraction:
http://94.228.169.143
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/a7312f01db21/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a7312f01db21efd84be0a4e596fefb6ebbc388655ab19a642bf44360f1409382

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/451084/

Comments