darkgate | 8b6c6c007efa8e1a7da241564142f8a8a934dcce451c7e522cdd86292e81ead7 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

1

e91874c5d8c2.msi

windows7-x64

e91874c5d8c2.msi

windows10-2004-x64

Sharing

General

Target

e91874c5d8c2.msi
Size

8.7MB
Sample

231110-xvcmgach8w
MD5

1170e2b02b92895d9db0be336d032d90
SHA1

18f49619d69b057e81163bdf08eab5f355ce662c
SHA256

8b6c6c007efa8e1a7da241564142f8a8a934dcce451c7e522cdd86292e81ead7
SHA512

bd1ceeee7928592e318b7f28b557bfcb97e4bb8f65f8c09001f19a746c7532f4f9d86aa54aab2866b5852921aa04a4f8de18e6c9109cc91c94c34879013c0134
SSDEEP

196608:YeS5hV9/S6WXbfXlTrn7HZ5AQX3AveLukj1w9cNzvhXoZJ+:YdhVs6WXjX9HZ5AQX32WD/oZY

Score

10^/10

darkgate user_871236672 discovery stealer

Static task

static1

Behavioral task

behavioral1

Sample

e91874c5d8c2.msi

Resource

win7-20231023-en

darkgate user_871236672 discovery stealer

windows7-x64

13 signatures

150 seconds

Behavioral task

behavioral2

Sample

e91874c5d8c2.msi

Resource

win10v2004-20231020-en

darkgate user_871236672 discovery stealer

windows10-2004-x64

13 signatures

150 seconds

Malware Config

Extracted

Family

darkgate

Botnet

user_871236672

C2

http://adhufdauifadhj13.com

Attributes

alternative_c2_port
8080
anti_analysis
true
anti_debug
true
anti_vm
true
c2_port
2351
check_disk
false
check_ram
true
check_xeon
true
crypter_au3
false
crypter_dll
false
crypter_rawstub
true
crypto_key
stanpttaHMuhnz
internal_mutex
txtMut
minimum_disk
40
minimum_ram
6002
ping_interval
4
rootkit
true
startup_persistence
true
username
user_871236672

Targets

- Target
  
  e91874c5d8c2.msi
- Size
  
  8.7MB
- MD5
  
  1170e2b02b92895d9db0be336d032d90
- SHA1
  
  18f49619d69b057e81163bdf08eab5f355ce662c
- SHA256
  
  8b6c6c007efa8e1a7da241564142f8a8a934dcce451c7e522cdd86292e81ead7
- SHA512
  
  bd1ceeee7928592e318b7f28b557bfcb97e4bb8f65f8c09001f19a746c7532f4f9d86aa54aab2866b5852921aa04a4f8de18e6c9109cc91c94c34879013c0134
- SSDEEP
  
  196608:YeS5hV9/S6WXbfXlTrn7HZ5AQX3AveLukj1w9cNzvhXoZJ+:YdhVs6WXjX9HZ5AQX32WD/oZY
Score

10^/10

darkgate user_871236672 discovery stealer
- DarkGate
  DarkGate is an infostealer written in C++.
  stealer darkgate
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

darkgateuser_871236672discoverystealer

behavioral2

darkgateuser_871236672discoverystealer

© 2018-2025

Terms | Privacy

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.