General
-
Target
2776-16-0x0000000004770000-0x0000000004B33000-memory.dmp
-
Size
3.8MB
-
Sample
231011-weeapaee33
-
MD5
e2d5ef2b67bfaea05e9f462fe9423cb9
-
SHA1
aaee59ff2127cd112ea700ae597edf20853b3e4d
-
SHA256
e0918ad27e67fa4fe62f6bab5b953bb23e8ba00d585694f99d1ecb9e0635d059
-
SHA512
7b601461538b24f1c008f204d523ab65be264df4f29a2867ee0eea4e081eeae87b5fd658c471c9aa04dc1e8014f18e4fb36e897abe01f19cb2fd114b545f09f0
-
SSDEEP
12288:/g7k+VDW7RywBWJ+LF1FY4qsQktcTTH1a9lTO8w7qnuF/VJC:/r+VDW9y9JKF1FHJQk2/Vabq8++uNH
Malware Config
Extracted
Family
darkgate
Botnet
Ricoc
C2
http://5.188.87.58
Attributes
-
alternative_c2_port
9999
-
anti_analysis
false
-
anti_debug
true
-
anti_vm
false
-
c2_port
2351
-
check_disk
false
-
check_ram
false
-
check_xeon
false
-
crypter_au3
true
-
crypter_dll
false
-
crypter_rawstub
false
-
crypto_key
DDrEhtzsHPvezn
-
internal_mutex
bKcDaE
-
minimum_disk
100
-
minimum_ram
4096
-
ping_interval
4
-
rootkit
true
-
startup_persistence
true
-
username
Ricoc