General
-
Target
http://178.33.9435
-
Sample
231211-zj9tyahafl
Score
10/10
Malware Config
Extracted
Language
ps1
Deobfuscated
URLs
exe.dropper
https://tt.vg/download-update-dll1
exe.dropper
https://tt.vg/dlldownload2sqliuit-download
exe.dropper
https://tt.vg/download-latest-update
Extracted
Family
darkgate
Version
C2
http://sanibroadbandcommunicton.duckdns.org
Attributes
-
anti_analysis
false
-
anti_debug
false
-
anti_vm
false
-
c2_port
5864
-
check_disk
false
-
check_ram
false
-
check_xeon
false
-
crypter_au3
false
-
crypter_dll
false
-
crypter_raw_stub
true
-
crypto_key
LAbQdWWsbybjAY
-
internal_mutex
bbcAde
-
minimum_disk
100
-
minimum_ram
4096
-
ping_interval
10
-
rootkit
false
-
startup_persistence
false
Extracted
Family
darkgate
Version
uPtZ
C2
http://sanibroadbandcommunicton.duckdns.org
Attributes
-
anti_analysis
false
-
anti_debug
false
-
anti_vm
false
-
c2_port
5864
-
check_disk
false
-
check_ram
false
-
check_xeon
false
-
crypter_au3
false
-
crypter_dll
true
-
crypter_raw_stub
false
-
crypto_key
qwNPPzrRTNHogf
-
internal_mutex
hykYbY
-
minimum_disk
100
-
minimum_ram
4096
-
ping_interval
1
-
rootkit
false
-
startup_persistence
true
Targets
-
-
Target
http://178.33.9435
Score10/10-
DarkGate
DarkGate is an infostealer written in C++.
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Drops startup file
-
Executes dropped EXE
-
Uses the VBS compiler for execution
-
Suspicious use of SetThreadContext
-