Overview

overview

10

Static

static

1

6e068b9dcd...70.msi

windows7-x64

10

6e068b9dcd...70.msi

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    13016592545.zip

  • Size

    1019KB

  • Sample

    231122-qke7aacg29

  • MD5

    b64469520b23030b1e41cc563edae292

  • SHA1

    ecef039c1dca2bf185b2b501b52d883923409706

  • SHA256

    a2fb0011e13f5c32cc13c95f954e6197373a68a7e724d719304021052374e659

  • SHA512

    30242ca8845ef9e5486860703cda39d534a2fe861f7943b52c4975a3721859949ac0444712fc7a388ec4284b2434f9984a9e07752a5c41975f862ac4ef3f5bfd

  • SSDEEP

    24576:SIVvuimvQcpsEjFbHrACT6WSd+tWz8K/gUqZfx4E3gPxUiw0:fW4cpsE53NT6P+Ql/o4E3gZtw0

Score
10/10
darkgatediscoverystealer

Malware Config

Extracted

Family

darkgate

C2

http://80.66.88.145

Attributes
  • anti_analysis

    false

  • anti_debug

    false

  • anti_vm

    false

  • c2_port

    7891

  • check_disk

    true

  • check_ram

    true

  • check_xeon

    false

  • crypter_au3

    true

  • crypter_dll

    false

  • crypter_rawstub

    false

  • crypto_key

    bIWRRCGvGiXOga

  • internal_mutex

    bbbGcB

  • minimum_disk

    50

  • minimum_ram

    4096

  • ping_interval

    4

  • rootkit

    true

  • startup_persistence

    true

Targets

    • Target

      6e068b9dcd8df03fd6456faeb4293c036b91a130a18f86a945c8964a576c1c70

    • Size

      1.8MB

    • MD5

      247a8cc39384e93d258360a11381000f

    • SHA1

      23893f035f8564dfea5030b9fdd54120d96072bb

    • SHA256

      6e068b9dcd8df03fd6456faeb4293c036b91a130a18f86a945c8964a576c1c70

    • SHA512

      336eca9569c0072e92ce16743f47ba9d6be06390a196f8e81654d6a42642ff5c99e423bfed00a8396bb0b037d5b54df8c3bde53757646e7e1a204f3be271c998

    • SSDEEP

      24576:ftncpVGP4I9FsEsyt8l+E+s1tB7parWM0+AL5QgZQvUXtAqlU0ZyMRp:epUP59FBJZEH1X1arF0vN/nX

    Score
    10/10
    darkgatediscoverystealer

    • DarkGate

      DarkGate is an infostealer written in C++.

      stealerdarkgate

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks