Overview

overview

10

Static

static

10

11112023_0...pm.exe

windows7-x64

10

11112023_0...pm.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    11112023_0211_drkgate_fsg_spm.bin

  • Size

    405KB

  • MD5

    ea11e4eddb477a163302661558efbee6

  • SHA1

    365726e734d98522586ac9d824dde3b132e214c4

  • SHA256

    3db5d689636ea71e3b64fdaeb64c4a38fed332630b6d5711dc9d21b4620d5651

  • SHA512

    5be1c007130a226056216bf29ee5f19511d273927b8a38d20c2fe492be6108c6466dffb8beba914f0a9e23e13bfc737b2e1d5390a86aea98c4289eb8aeb797ba

  • SSDEEP

    6144:m5UHKhp9UQpT0E3OWRytzcUE/Gm1GML4xVDbzKlogClfwkJKbjY:QUHKJ0E3OWRytCn3L4x9bmlogClokJD

Score
10/10
user_871236672darkgate

Malware Config

Extracted

Family

darkgate

Botnet

user_871236672

C2

http://adhufdauifadhj13.com

Attributes
  • alternative_c2_port

    8080

  • anti_analysis

    true

  • anti_debug

    true

  • anti_vm

    true

  • c2_port

    2351

  • check_disk

    false

  • check_ram

    true

  • check_xeon

    true

  • crypter_au3

    false

  • crypter_dll

    false

  • crypter_rawstub

    true

  • crypto_key

    stanpttaHMuhnz

  • internal_mutex

    txtMut

  • minimum_disk

    40

  • minimum_ram

    6002

  • ping_interval

    4

  • rootkit

    true

  • startup_persistence

    true

  • username

    user_871236672

Signatures

  • Darkgate family
    darkgate
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 11112023_0211_drkgate_fsg_spm.bin
    .exe windows:4 windows x86

    Password: infected


    Headers

    Sections