11102023_1839_drkgate_1110[.]bin | Triage

Resubmissions

11-10-2023 13:29

231011-qq7tgsbh66 3

11-10-2023 10:39

231011-mqgerahb9x 3

Sharing

Reason

config extraction: CfgExtr crashed: 'DarkGate' runtime error: invalid memory address or nil pointer dereference

General

Target

11102023_1839_drkgate_1110.bin
Size

388KB
MD5

7ed92cbc082874cc7a4807f67244e85b
SHA1

a592a39b1850e08c7956e2ffc9d1c0875e805c8c
SHA256

dda5e4889f9adbd0733558ea72934f65944f748fe77c06f9fcbbadbc0ac0b66b
SHA512

c52f3fd75dd0cd129012fef6c473ee42d23a1b4ac18cdcebe35e41d8b62cda2c4c338b55532523b6196f4e97ad062b2082605e80fc05c70cf26f110fdc16682c
SSDEEP

6144:s50tl7kAfri5ZhtWtIv9n0YQFaVfTnU6UVtm+aq1nMyCCvgT2Pt:a0tlBi5ZhtWtIv50genn91n1CCvj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
11102023_1839_drkgate_1110.bin

Files

11102023_1839_drkgate_1110.bin
.exe windows:4 windows x86

Password: infected

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 331KB - Virtual size: 330KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 12B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ