Overview

overview

10

Static

static

1

bye.vbs

windows7-x64

8

bye.vbs

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4c4a5c51dc3e8cf6b2a3f6fd54008593002daa180fe73489e93da5e0d152be4f_JC.zip

  • Size

    8KB

  • Sample

    231003-rl9b7add47

  • MD5

    d6b313db30bdee5611135842893c038b

  • SHA1

    356a4b9d823703d240d1b1967ddb345118a129a7

  • SHA256

    4c4a5c51dc3e8cf6b2a3f6fd54008593002daa180fe73489e93da5e0d152be4f

  • SHA512

    477bc0adbf985dd4d38376de104bfafa899471ac3691b1548fc5af688936d2b6590e3d38c9a91fa3f7352536f82d9b9fd28b32e7826ca6d341c7e8245342a438

  • SSDEEP

    192:+RBfgP3tKk4wuMCkjJ0rAphB+oHq4rUQPfP4UHF37aozQG:sBoPdKbweoZKw7f5FL/UG

Score
10/10
darkgatestealer

Malware Config

Extracted

Family

darkgate

C2

http://searcherbigdealk.com

Targets

    • Target

      bye.vbs

    • Size

      19KB

    • MD5

      a19d814f720701a258a6e8b5a22b22c9

    • SHA1

      cbdcdefb3328f1473bb1da624ed2bf9515ffd2c3

    • SHA256

      7d4115e88411e7bcac9ed622dbb6554ff4015c6f9fed98a5427970ceada526e6

    • SHA512

      51b2a31f0c4fce15d87d1ab88d8e383ee7f8be0e9075183a22c6bfcca48dd30d43ca7987baf3c811ab11a4132199a31213d3096c91a645127f13b7703d3bd044

    • SSDEEP

      384:fwcem3DxZbJ6TZZfOEcMR/vuvP3RhbWbdVIIo+T6ncfzeQhs7h7:YcXZ16/+MRSbbaX9yp7h7

    Score
    10/10
    darkgatestealer

    • DarkGate

      DarkGate is an infostealer written in C++.

      stealerdarkgate

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks