General
-
Target
4528-16-0x0000000004270000-0x0000000004633000-memory.dmp
-
Size
3.8MB
-
MD5
727b6408e7c0664ebaeb5e339755c751
-
SHA1
875307df380b73c2a555f80cdb9e16e0e3aa283a
-
SHA256
5d8f18f72bb20e5b36de6608bc8b5784cdf9f88149eecffa09771061cf214e64
-
SHA512
ccf583920eb5dcf4d644896e6c4abb01ddf86567150b1141ddaf3c9305171fa50835b91d9c25fc7d7ea2b8e194f3b85c9fb418166d3434b2fca96ed2c8ad8891
-
SSDEEP
24576:P7AWNItEe5KVVe+pQ0m/d3a76cd+utJr:P7K7Ym/Fa7+mr
Malware Config
Extracted
Family
darkgate
Botnet
AA11
C2
http://94.228.169.123
http://178.236.247.73
Attributes
-
alternative_c2_port
8080
-
anti_analysis
false
-
anti_debug
true
-
anti_vm
false
-
c2_port
2351
-
check_disk
false
-
check_ram
false
-
check_xeon
false
-
crypter_au3
true
-
crypter_dll
false
-
crypter_rawstub
false
-
crypto_key
nxnjYDThgzyWBp
-
internal_mutex
txtMut
-
minimum_disk
100
-
minimum_ram
4096
-
ping_interval
4
-
rootkit
true
-
startup_persistence
true
-
username
AA11
Signatures
-
Darkgate family
Files
-
4528-16-0x0000000004270000-0x0000000004633000-memory.dmp