MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b13b795f369654dd25bc0ffa2bc26b3d2eb07270df04cfd197ffdf8a6c61cde8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

DarkGate

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	b13b795f369654dd25bc0ffa2bc26b3d2eb07270df04cfd197ffdf8a6c61cde8
SHA3-384 hash:	5667110c4cf2077cf0a9cbe2f15f77d6bbeb7c0c358a8f3340f6d9d8be9d62a4727338e88cd914c44bc194d7fadd4810
SHA1 hash:	117f5e98644c5e905f9f966d9815bd874d23d6b8
MD5 hash:	698d299b604f8750aadc3362290ad13e
humanhash:	maryland-stairway-happy-beryllium
File name:	script.au3
Download:	download sample
Signature	DarkGate Create hunting rule
File size:	501'150 bytes
First seen:	2023-11-03 20:44:59 UTC
Last seen:	Never
File type:
MIME type:	application/octet-stream
ssdeep	12288:6zEvFgmuqkZTltA7XIf3y5ByZErTWERji:c8Fg3qqtEXImGEr7w
TLSH	T118B4CF7AFEC199859732B90BD2E7C6CD8F41825A84BD4DC704C93438EEB79815BDEA01
Reporter	Xev
Tags:	au3 DarkGate

Intelligence

File Origin

# of uploads :

# of downloads :

232

Origin country :

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.AutoIT-86.UNOFFICIAL

Verdict:

No Threat

Threat level:

2.5/10

Confidence:

100%

Tags:

masquerade

Link:

https://www.filescan.io/uploads/65455bd32546bd423f10a5e9/reports/dce6ad92-81bb-4f73-9853-18326a85469b/overview

Verdict:

Malicious

Labled as:

Injector.Autoit

Link:

https://www.hybrid-analysis.com/sample/b13b795f369654dd25bc0ffa2bc26b3d2eb07270df04cfd197ffdf8a6c61cde8

Result

Verdict:

MALICIOUS

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b13b795f369654dd25bc0ffa2bc26b3d2eb07270df04cfd197ffdf8a6c61cde8/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=we5xsxzwszkn2jn4b75cxqtlhuxla4tq34cm7umx77pyu3dbzxua._file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.05

Link:

https://yomi.yoroi.company/submissions/b13b795f369654dd25bc0ffa2bc26b3d2eb07270df04cfd197ffdf8a6c61cde8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.