General
-
Target
3512-9-0x00000000040C0000-0x00000000043F2000-memory.dmp
-
Size
3.2MB
-
Sample
231031-3dadnsfe3t
-
MD5
f1d495951b5970de90af3c247401112c
-
SHA1
8892eadb503f7eda953eb9a9d84fbd96dc7f35b2
-
SHA256
48f39162022915e947dd6355ace83fa24557501e1d13cb1cf848637edd396238
-
SHA512
9055fec7b36dc190bc3d6547488a66f31852f38f5555c329d3fb21adc764dd3b497f9d07d95fe45d416e350f71ec120d076852384d13da07035347cf024a953f
-
SSDEEP
6144:LZk2vpO8WxBUyTi0yJdqK31yziT4uqPzVPJhYRoGJT85d:NkUpO8WvTi0yJdqyM3LVBvGJu
Behavioral task
behavioral1
Sample
3512-9-0x00000000040C0000-0x00000000043F2000-memory.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
3512-9-0x00000000040C0000-0x00000000043F2000-memory.exe
Resource
win10v2004-20231025-en
Malware Config
Extracted
darkgate
Ricoc3
http://hgfdytrywq.com
-
alternative_c2_port
8080
-
anti_analysis
false
-
anti_debug
false
-
anti_vm
false
-
c2_port
80
-
check_disk
false
-
check_ram
false
-
check_xeon
false
-
crypter_au3
false
-
crypter_dll
false
-
crypter_rawstub
true
-
crypto_key
uwCQCDKnhIZhrE
-
internal_mutex
txtMut
-
minimum_disk
100
-
minimum_ram
4096
-
ping_interval
4
-
rootkit
true
-
startup_persistence
true
-
username
Ricoc3
Targets
-
-
Target
3512-9-0x00000000040C0000-0x00000000043F2000-memory.dmp
-
Size
3.2MB
-
MD5
f1d495951b5970de90af3c247401112c
-
SHA1
8892eadb503f7eda953eb9a9d84fbd96dc7f35b2
-
SHA256
48f39162022915e947dd6355ace83fa24557501e1d13cb1cf848637edd396238
-
SHA512
9055fec7b36dc190bc3d6547488a66f31852f38f5555c329d3fb21adc764dd3b497f9d07d95fe45d416e350f71ec120d076852384d13da07035347cf024a953f
-
SSDEEP
6144:LZk2vpO8WxBUyTi0yJdqK31yziT4uqPzVPJhYRoGJT85d:NkUpO8WvTi0yJdqyM3LVBvGJu
Score1/10 -