General

  • Target

    file

  • Size

    306KB

  • Sample

    231002-tqjnfaec52

  • MD5

    45d3751f9cc18700954e3ce972dc9203

  • SHA1

    fb0125382f73bdde18b994d2323287f6974f3033

  • SHA256

    71f78f7ce37254d501c06589cc40be71c94a1a90559c4e19390da4b70457de25

  • SHA512

    ca619679ba3f8f7f5058f45ba25e2f6f3aa7edee066a417400e4cdbf5ffd8b55cd90232879f7cb8144210d91e9f8d78c0cc10cd9542ebcd6b22d6ae538b4800a

  • SSDEEP

    3072:YidgAkHnjPFQ6KSEf/d7HJPaW+LN7DxRLlzglKh1EW/:lgAkHnjPFQBSEd7pPCN7jBh1EW/

Malware Config

Extracted

Family

darkgate

C2

http://81.19.135.17

Targets

    • Target

      file

    • Size

      306KB

    • MD5

      45d3751f9cc18700954e3ce972dc9203

    • SHA1

      fb0125382f73bdde18b994d2323287f6974f3033

    • SHA256

      71f78f7ce37254d501c06589cc40be71c94a1a90559c4e19390da4b70457de25

    • SHA512

      ca619679ba3f8f7f5058f45ba25e2f6f3aa7edee066a417400e4cdbf5ffd8b55cd90232879f7cb8144210d91e9f8d78c0cc10cd9542ebcd6b22d6ae538b4800a

    • SSDEEP

      3072:YidgAkHnjPFQ6KSEf/d7HJPaW+LN7DxRLlzglKh1EW/:lgAkHnjPFQBSEd7pPCN7jBh1EW/

    • DarkGate

      DarkGate is an infostealer written in C++.

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks