Overview

overview

10

Static

static

1

25102023_s...r).msi

windows7-x64

10

25102023_s...r).msi

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    25102023_start-update(repair).msi

  • Size

    7.7MB

  • Sample

    231027-kakfcseg79

  • MD5

    28d52e086408d402df97e8040364fed3

  • SHA1

    c5a36c91356403ac26544a92068a1f62ba78c9a0

  • SHA256

    b71c08272c92e668cd4223c07fa317686fa0ac11ea71e823b7cad33a2c759d6e

  • SHA512

    198e7cbd48b547d03047f0e1e6c820aa5472803968e2b00ff8b3428a073c66a7bf285034ec4db80d4e119339704c078d7bd8df48945d0c2a0c61f0ac2cab6ac1

  • SSDEEP

    98304:spaKjsEZcgsdUqakFRFawTV82ASqQBW9vpWzxjFycvniqy33XglSB2CiU39osj1:G1NsUqai/pTOryNnxyXxBTie1IwXc3u

Score
10/10
darkgateads5discoverystealer

Malware Config

Extracted

Family

darkgate

Botnet

ADS5

C2

http://sftp.bitepieces.com

Attributes
  • alternative_c2_port

    8080

  • anti_analysis

    true

  • anti_debug

    true

  • anti_vm

    true

  • c2_port

    443

  • check_disk

    true

  • check_ram

    true

  • check_xeon

    true

  • crypter_au3

    false

  • crypter_dll

    false

  • crypter_rawstub

    true

  • crypto_key

    qOkWlecWaIQRgm

  • internal_mutex

    txtMut

  • minimum_disk

    30

  • minimum_ram

    6000

  • ping_interval

    4

  • rootkit

    true

  • startup_persistence

    true

  • username

    ADS5

Targets

    • Target

      25102023_start-update(repair).msi

    • Size

      7.7MB

    • MD5

      28d52e086408d402df97e8040364fed3

    • SHA1

      c5a36c91356403ac26544a92068a1f62ba78c9a0

    • SHA256

      b71c08272c92e668cd4223c07fa317686fa0ac11ea71e823b7cad33a2c759d6e

    • SHA512

      198e7cbd48b547d03047f0e1e6c820aa5472803968e2b00ff8b3428a073c66a7bf285034ec4db80d4e119339704c078d7bd8df48945d0c2a0c61f0ac2cab6ac1

    • SSDEEP

      98304:spaKjsEZcgsdUqakFRFawTV82ASqQBW9vpWzxjFycvniqy33XglSB2CiU39osj1:G1NsUqai/pTOryNnxyXxBTie1IwXc3u

    Score
    10/10
    darkgateads5discoverystealer

    • DarkGate

      DarkGate is an infostealer written in C++.

      stealerdarkgate

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks