Overview

overview

10

Static

static

1

5845.msi

windows7-x64

10

5845.msi

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5845.msi

  • Size

    3.6MB

  • Sample

    231018-r21d8afc6x

  • MD5

    5d17961906342f3d3f8e37013b8dbc4b

  • SHA1

    2482e10f67afc8732c8ba12219e5190ac0816893

  • SHA256

    7081e4b1bffb4c839b937aa5938d83ca6a1dfbd0919917c54c829d8efc40ed34

  • SHA512

    99ed066d6b900d9505296ce1b2c80ce0fcb84a8ad22a1d22fd432910530105e30e0c73a47b7a6de4ab701c83386ba1187fd2f5bc40a1c2ea6c5d4955c688b19e

  • SSDEEP

    98304:dpq1DCG1G1w7cwv9JAEGl6ZMjjzpgWxY/f7L7yiSVw8y:UE+dvLAEGl6S5oX7i

Score
10/10
darkgateuser_871236672discoverystealer

Malware Config

Extracted

Family

darkgate

Botnet

user_871236672

C2

http://cheneseemeg7575.cash

http://annoyingannoying.vodka

http://uiahbmajokriswhoer.net
Attributes
  • alternative_c2_port

    8080

  • anti_analysis

    true

  • anti_debug

    true

  • anti_vm

    true

  • c2_port

    2351

  • check_disk

    true

  • check_ram

    true

  • check_xeon

    true

  • crypter_au3

    false

  • crypter_dll

    false

  • crypter_rawstub

    true

  • crypto_key

    ScfmVowTLpyVbK

  • internal_mutex

    txtMut

  • minimum_disk

    35

  • minimum_ram

    6000

  • ping_interval

    4

  • rootkit

    true

  • startup_persistence

    true

  • username

    user_871236672

Targets

    • Target

      5845.msi

    • Size

      3.6MB

    • MD5

      5d17961906342f3d3f8e37013b8dbc4b

    • SHA1

      2482e10f67afc8732c8ba12219e5190ac0816893

    • SHA256

      7081e4b1bffb4c839b937aa5938d83ca6a1dfbd0919917c54c829d8efc40ed34

    • SHA512

      99ed066d6b900d9505296ce1b2c80ce0fcb84a8ad22a1d22fd432910530105e30e0c73a47b7a6de4ab701c83386ba1187fd2f5bc40a1c2ea6c5d4955c688b19e

    • SSDEEP

      98304:dpq1DCG1G1w7cwv9JAEGl6ZMjjzpgWxY/f7L7yiSVw8y:UE+dvLAEGl6S5oX7i

    Score
    10/10
    darkgateuser_871236672discoverystealer

    • DarkGate

      DarkGate is an infostealer written in C++.

      stealerdarkgate

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks