General
-
Target
final.bin
-
Size
3.2MB
-
MD5
24177e15669d5c9a3ba8ca804aa9abfa
-
SHA1
32beebeed89a9fb974ea1563b22694265ec29c56
-
SHA256
0bdf0f1872235196a7e77a04979c2195009681dd0dbb523551dc5a3943d0ae46
-
SHA512
ac0fd5485a3dde47b56c73a0775fd99cc8483ee9552c36528ac135f588e12ed7bef866b17fb73d8dc941f0ab26a5a30bfe47eca453efa0c4789937744b691694
-
SSDEEP
12288:0UEpOEWzuYzy/Bda9AlxhwcySTcth/4N:0fOEWjyZda9uhwlSIf4
Score
10/10
Malware Config
Extracted
Family
darkgate
Version
5.2.4
Botnet
civilian1337
C2
http://185.130.227.202
Attributes
-
alternative_c2_port
8080
-
anti_analysis
false
-
anti_debug
false
-
anti_vm
false
-
c2_port
2351
-
check_disk
false
-
check_ram
false
-
check_xeon
false
-
crypter_au3
false
-
crypter_dll
false
-
crypter_raw_stub
true
-
crypto_key
VPsTDMdPtonzYs
-
internal_mutex
txtMut
-
minimum_disk
100
-
minimum_ram
4096
-
ping_interval
4
-
rootkit
true
-
startup_persistence
true
-
username
civilian1337
Signatures
-
Darkgate family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
final.bin
Headers
Sections