Overview

overview

10

Static

static

1

07112023_0...d4).js

windows7-x64

3

07112023_0...d4).js

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    07112023_0247_app(060e45bf7b57d4).js

  • Size

    252KB

  • Sample

    231106-xfnq7adb2x

  • MD5

    52084d5af42edfe681c380b0fd8d1ca3

  • SHA1

    dcc445bb4a504c2bd1e0c3f0251b3fe4bf60c5b3

  • SHA256

    8f7c401cde820120aedfc52946a8493e0540ab3f9eaa38a4e8d138389e89bc84

  • SHA512

    b58d3973ea47c268c789915d94527a45a79165243015ccc69cbee29376cc4faed40b3abf0c9ebe2ac10bc1019bc55ee5e32b90a22432f541b361e34c9e985ac1

  • SSDEEP

    6144:je7hgXeerjqlI2Iro+He7hgXeerjqlI2Iro+8:jIhgSlI238IhgSlI23V

Score
10/10
darkgateads5stealer

Malware Config

Extracted

Family

darkgate

Botnet

ADS5

C2

http://twittesling.com

Attributes
  • alternative_c2_port

    8080

  • anti_analysis

    true

  • anti_debug

    true

  • anti_vm

    true

  • c2_port

    443

  • check_disk

    false

  • check_ram

    true

  • check_xeon

    false

  • crypter_au3

    false

  • crypter_dll

    false

  • crypter_rawstub

    true

  • crypto_key

    ZYOhfbEEcDFGAf

  • internal_mutex

    txtMut

  • minimum_disk

    40

  • minimum_ram

    5000

  • ping_interval

    4

  • rootkit

    true

  • startup_persistence

    true

  • username

    ADS5

Targets

    • Target

      07112023_0247_app(060e45bf7b57d4).js

    • Size

      252KB

    • MD5

      52084d5af42edfe681c380b0fd8d1ca3

    • SHA1

      dcc445bb4a504c2bd1e0c3f0251b3fe4bf60c5b3

    • SHA256

      8f7c401cde820120aedfc52946a8493e0540ab3f9eaa38a4e8d138389e89bc84

    • SHA512

      b58d3973ea47c268c789915d94527a45a79165243015ccc69cbee29376cc4faed40b3abf0c9ebe2ac10bc1019bc55ee5e32b90a22432f541b361e34c9e985ac1

    • SSDEEP

      6144:je7hgXeerjqlI2Iro+He7hgXeerjqlI2Iro+8:jIhgSlI238IhgSlI23V

    Score
    10/10
    darkgateads5stealer

    • DarkGate

      DarkGate is an infostealer written in C++.

      stealerdarkgate

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks