Extracted

• • Target

    1.vbs

  • Size

    1KB

  • MD5

    95f1a044adb17a561ca70b168ff37708

  • SHA1

    7d43e2db9cb63b91468a442acd60ceda4045eb8b

  • SHA256

    f1ae3678094d1318cb052009429fb96caec758ce3238ea10decd5df8db84a8a1

  • SHA512

    3cb9df7b775e4aba2a5696e7b176efa64ea15d243bdea2dd8e3e8cf79ed5be14f5063da7e8d6861ddd72598b688dda3c0678e1bfa42a9d5ecd35233369181040

  Score

  10^/10

  darkgatestealer

  • DarkGate

    DarkGate is an infostealer written in C++.

    stealerdarkgate

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2