General
-
Target
4920-14-0x0000000004860000-0x0000000004C23000-memory.dmp
-
Size
3.8MB
-
Sample
231011-n8lmvsfg73
-
MD5
0141d8577376b62c4b706ea49089ecf0
-
SHA1
f16c85992d52da18b30fb20c607328d9952ee493
-
SHA256
6a24fee6acdbef573181cebfe85045700e3fa403f52937c81c60e07c975d3ad0
-
SHA512
d6e046ee690b441f3d57db13b707364f6cf6af810fd9497d232693198037ce907d7d9eeec5377484778cf5e3242cfcacfddc275b54f013787a007a7029b39bef
-
SSDEEP
12288:gLt4n9W7cUbjTMqD5XORMxR7FkNsucsfQjCTayTyAqnuR/SJC:gLs9WoUrMqD1ORuXkNpnICTdTyA+uBS
Malware Config
Extracted
Family
darkgate
Botnet
AA11
C2
http://94.228.169.143
Attributes
-
alternative_c2_port
8080
-
anti_analysis
true
-
anti_debug
true
-
anti_vm
false
-
c2_port
2351
-
check_disk
false
-
check_ram
false
-
check_xeon
false
-
crypter_au3
true
-
crypter_dll
false
-
crypter_rawstub
false
-
crypto_key
QftsbpyrJeATQI
-
internal_mutex
txtMut
-
minimum_disk
100
-
minimum_ram
4096
-
ping_interval
4
-
rootkit
true
-
startup_persistence
true
-
username
AA11