General
-
Target
decoded.exe
-
Size
377KB
-
MD5
1b0a156b709bfb81d60749bb64112998
-
SHA1
5e122fbc4bc15869df9615c6407b45dbc310274e
-
SHA256
c4a43cd823459d76879befaac51d314e5239ee3d54ff1396a8b7a1add00c12fd
-
SHA512
35eca4f427685b834368871759898c11532852c6b3b5b49d3b686c8e512a6c0c3a78d40c0c8889da0ce8ab1f57973e0e9106351d66a13a095ce62290bdda4111
-
SSDEEP
6144:u5UTExW+vRaLjH5XVEqVomFDXfRhnJWoS1gAlCWZ42w:YUTExWnLjH5XVEqVvvnJWoSiAlTZ4
Score
10/10
Malware Config
Extracted
Family
darkgate
Botnet
civilian1111
C2
http://185.130.226.220
Attributes
-
alternative_c2_port
8080
-
anti_analysis
true
-
anti_debug
true
-
anti_vm
true
-
c2_port
2351
-
check_disk
false
-
check_ram
false
-
check_xeon
false
-
crypter_au3
false
-
crypter_dll
false
-
crypter_rawstub
true
-
crypto_key
vsAuhYDgOqBrvG
-
internal_mutex
txtMut
-
minimum_disk
100
-
minimum_ram
4096
-
ping_interval
5
-
rootkit
true
-
startup_persistence
true
-
username
civilian1111
Signatures
-
Darkgate family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
decoded.exe
Headers
Sections