Overview

overview

10

Static

static

1

04112023_0...10).js

windows7-x64

3

04112023_0...10).js

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    04112023_0757_online-package(0x1010010).js

  • Size

    252KB

  • Sample

    231103-3zj51abc3t

  • MD5

    71c6839fd63593797e796fbd21162538

  • SHA1

    d3a32638fef4c0528ea172cbdbd6a3e1024cac55

  • SHA256

    c1c99b9831d48df390c46dc373f8f5691364aa0118cc50484f0efcb2c8cad4df

  • SHA512

    d662c361e74fbc8e4aa6c8bb3029d123cad276378bb273ce74eee2c5407c0883abeb19de340f6459059da8f22ca40515e923f343a27ba4ec0b4fea4e3bd7b355

  • SSDEEP

    6144:Qe7hgXeerjqlI2Iro+ee7hgXeerjqlI2Iro+8:QIhgSlI23vIhgSlI23V

Score
10/10
darkgateads5stealer

Malware Config

Extracted

Family

darkgate

Botnet

ADS5

C2

http://sftp.noheroway.com

Attributes
  • alternative_c2_port

    8080

  • anti_analysis

    false

  • anti_debug

    true

  • anti_vm

    false

  • c2_port

    443

  • check_disk

    false

  • check_ram

    false

  • check_xeon

    false

  • crypter_au3

    false

  • crypter_dll

    false

  • crypter_rawstub

    true

  • crypto_key

    RcuzkMweaXiPDc

  • internal_mutex

    txtMut

  • minimum_disk

    45

  • minimum_ram

    5000

  • ping_interval

    4

  • rootkit

    true

  • startup_persistence

    true

  • username

    ADS5

Targets

    • Target

      04112023_0757_online-package(0x1010010).js

    • Size

      252KB

    • MD5

      71c6839fd63593797e796fbd21162538

    • SHA1

      d3a32638fef4c0528ea172cbdbd6a3e1024cac55

    • SHA256

      c1c99b9831d48df390c46dc373f8f5691364aa0118cc50484f0efcb2c8cad4df

    • SHA512

      d662c361e74fbc8e4aa6c8bb3029d123cad276378bb273ce74eee2c5407c0883abeb19de340f6459059da8f22ca40515e923f343a27ba4ec0b4fea4e3bd7b355

    • SSDEEP

      6144:Qe7hgXeerjqlI2Iro+ee7hgXeerjqlI2Iro+8:QIhgSlI23vIhgSlI23V

    Score
    10/10
    darkgateads5stealer

    • DarkGate

      DarkGate is an infostealer written in C++.

      stealerdarkgate

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks