Overview

overview

10

Static

static

1

Run-AU3-1.bat

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Malware-1.zip

  • Size

    765KB

  • Sample

    231027-yg1b2sad82

  • MD5

    23ce83e701b715f77e4bd7eb89cad213

  • SHA1

    38d92f66a136430e9e2f3b6ebd52ab301502ee20

  • SHA256

    f637eee856596f0e6fe66ffcd31bd049f689df0a9f81e4b56c8e5323f155bbe0

  • SHA512

    867d77af1be1efa2d17db3037fa8c38864b08ede29b3fc46beb577ca8ca6ea71f7a62f21b4b8d97133320261759c733248616b1819583d689365fd54fe6cf516

  • SSDEEP

    12288:fhjJs9uHpnB7DNbnDJ4wFY8YXsCdLsXOjgp+6ifgjmDOFms/I0jiXvQ2sZIinukz:5ls9eB1jCwFY8cse0+3fgjmDcPWXhaug

Score
10/10
darkgatecivilian1111stealer

Malware Config

Extracted

Family

darkgate

Botnet

civilian1111

C2

http://185.130.226.220

Attributes
  • alternative_c2_port

    8080

  • anti_analysis

    true

  • anti_debug

    true

  • anti_vm

    true

  • c2_port

    2351

  • check_disk

    false

  • check_ram

    false

  • check_xeon

    false

  • crypter_au3

    false

  • crypter_dll

    false

  • crypter_rawstub

    true

  • crypto_key

    vsAuhYDgOqBrvG

  • internal_mutex

    txtMut

  • minimum_disk

    100

  • minimum_ram

    4096

  • ping_interval

    5

  • rootkit

    true

  • startup_persistence

    true

  • username

    civilian1111

Targets

    • Target

      Run-AU3-1.bat

    • Size

      27B

    • MD5

      357727830de82bc1113687368ee84c11

    • SHA1

      799c33583f05fb2f9a4e25d61117480271124dd2

    • SHA256

      3a46599f80c7345752b625df247c1b8c35c7331fe71050da77727bf713da58b1

    • SHA512

      dc19d1a23852769775bcd3f9a4089aa8f38b2d5f98ba4d3de7de83f5fe094b1040be60fb05b5fd7147073428e51ef3ddfff11425890d3bc81f5baedab645416a

    Score
    10/10
    darkgatecivilian1111stealer
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks