darkgate

Sharing

Copy URL Twitter E-mail

General

Target
zipzip.zip
Size 500KB
Sample240207-drfp6scbb6
SHA256 329db242a00f0dcf4e2f6390b06c837fd992cabb2cc4d0eda8278a8c57d4b044
MD5 235330b79839fb8eec4c68810166747b
SHA1 c952e921afe299842df337c4ae084ca8916fbed4
SHA512 07ce5e7bd45e4af12d360937d6ca1a1840fe7b8fbe8486b366156cd8263b4c218c2a5767a237a7b1a14dc20ad1c348c4fcf0ed8f983314ae5f96e8fb88de366f
SSDEEP 12288:XGGToXqB1GfnYUI7i19s5uOAacotvkDc1HZ56gWDz92/tEKtXid:XGGkVAUI729Iupots+ADRKpid
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

darkgate

Version

5.0.19

Botnet

Ricoc3

http://hgfdytrywq.com

Attributes

alternative_c2_port
8080
anti_analysis
false
anti_debug
false
anti_vm
false
c2_port
80
check_disk
false
check_ram
false
check_xeon
false
crypter_au3
false
crypter_dll
false
crypter_raw_stub
true
crypto_key
VRXdjHZqDRJqyD
internal_mutex
txtMut
minimum_disk
100
minimum_ram
4096
ping_interval
4
rootkit
true
startup_persistence
true
username
Ricoc3

Targets

- Target
  2023-10-12-AutoIt-script-file-for-DarkGate-example-1-of-3.au3
- Size 12KB
- SHA256 c01d186f412fac04b0b80c6242c378ee00d1c63affb83d44ee75f65a08f4e966
- MD5 1d9e64a4fb4eddc87df990d8e9be6cae
- SHA1 1b6bbc58d0153247e418bd2cb6665057601ff075
- SHA512 16cb48892e0effafe0f643f7736fa44aeed8f653dc2558ceab3c4eb95132b5e67c3eebc47af9dcddc2cfd4a2e04278fc5c651590f2bb3fe5baacc3a85bdfca64
- SSDEEP 96:LAQ3RilxfVyAEHp2VJpqL6zZmq2Cws+2J6uXA+srR/6kdUWot1KTDi8xxLtc7IS2:c12LJ56MHLunqVLtynAU2n4VY7E3wJ
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral1 behavioral2
- Target
  2023-10-12-AutoIt-script-file-for-DarkGate-example-2-of-3.au3
- Size 12KB
- SHA256 d841110e05dc8970c1f96ec038ff98a4f463c2b5e96d114a84e4c3bb97628797
- MD5 6d9d11d08feae9b76c114ad71e2ff557
- SHA1 02dc6cc3b5b35295d2f826f83dd0cb07c3398ba5
- SHA512 00edbf73cffa59db36c55922a5a52e2b51d45ae488d836304ae83f14a406db64cc7a629b95b50f2575e21bdbd6f1b0639660f5af01b10333cf2220951f0f03ed
- SSDEEP 192:12SwsOtdDs2rfRn4kkKRALLfgmguAsF222DdtXZ:nolsmZAKRAvfgmguAsmD3Z
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3 behavioral4
- Target
  2023-10-12-AutoIt-script-file-for-DarkGate-example-3-of-3.au3
- Size 12KB
- SHA256 c786fba049049139859c8d552f957780628b437c11af0720c0c13481897b7244
- MD5 d46ba051ead139b4db7584becbe9ca7b
- SHA1 582a056fe75f1a375c56c976cefd32063e26633f
- SHA512 ac74fed64b8ecb48fe860630cb97e16da1133876510304c56340bc451c46d91cbba236eed9d29dd858e544adab74e010821e6f560b03dfe083f4fe6077198cca
- SSDEEP 192:GbHNdPlw5g+k4Vv5//ReRuzvoN/zqqkFYvD//gdCWaSH:wdPkg+1hBnvoNrqqkFY800H
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral5 behavioral6
- Target
  2023-10-12-DarkGate-IOCs.txt
- Size 4KB
- SHA256 6dceda97bd6fca9f4b77f397883cc362562f618d90514e41fa360d53e838f607
- MD5 92e3ec320e60e76b800de5899ee86915
- SHA1 91e6e9876fb9ef8b7aa4d3a540abd1c108419b43
- SHA512 224e538a03b4733b00628fdbc011888f2afaaded7f79636c760d46f46153a9a3c0eebee337e3002a5e49ce78dc265ffc83660218a1a843e584679463da3b3e67
- SSDEEP 96:P4mEjI4DQCKliWc2O2FOOyuFOOykXE0YbnTVxDiJdfMwbZb:uHoiW/AhuAhkXDYz2dfnbZb
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral7 behavioral8
- Target
  2023-10-12-decoded-EXE-retrieved-by-au3-script.bin
- Size 388KB
- SHA256 7fc3126b9c53816657076b62188f9905067ec4b070deea5999cd6d7aa3c85c76
- MD5 d90f88cd13ddbd5273133dc5fc062f19
- SHA1 c7161197ef24a856106abc8b5c1946b6a51e686c
- SHA512 944295a3a87fa34a90a1f7450d015e5c0d81ea9dcaf02e1e3a3880f1e8a240e9a89b8eb08a3776f90ac0dccd9e9bccf547c63628d240c05cfc94ac55b9170a90
- SSDEEP 6144:s50tl7kAfri5ZhtWtIv9n0YQFaVfTnU6UVtmSaq1nMyCC3gT2Pt:a0tlBi5ZhtWtIv50genz91n1CC3j
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

darkgate ricoc3 stealer
- DarkGate
  DarkGate is an infostealer written in C++.
  stealer darkgate
- Detect DarkGate stealer
- Suspicious use of NtCreateUserProcessOtherParentProcess
behavioral10 behavioral9
- Target
  2023-10-12-encoded-binary-retrieved-by-au3-script.bin
- Size 388KB
- SHA256 307e554435ba5edc9c2b1d11e940d5656f748bd399465ae05dfc4a40e30a363f
- MD5 428a589184fdee0acc2906261fa0c579
- SHA1 cae63c6f8fbfedfa59c50e06881371209b1b4171
- SHA512 ee513cf78a115224a2650fdc22a87102da96ea5e573e296908bbeb636e9f33675ef3bbe9707239548d0cc028043c64ab1112e52ddd6c28b12dfbf6924d604514
- SSDEEP 12288:6mK3FJgNdwR8mNaR3Ntc0fYlP28FmihtI:7K3FUi8mNOt1fYM8he
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral11 behavioral12
- Target
  2023-10-12-shortcut-for-DarkGate-example-1-of-3.lnk.bin
- Size 2KB
- SHA256 ba18f678b08580795416148d2bba5b0a0b7be4c85b8501a28f49c8141268ec57
- MD5 dfc6cf8b82837441164308af04c3884f
- SHA1 36bcadb22fe93caf76fc5c68210f33eb8c7df0c0
- SHA512 1f8d89eeb4d082ab17a31085de46901acd5a9cccabb71e8fc2d0ac7ba798e81ef6a5a9433289cac660d01eb673caa82a656d85aa6dc49ad441b23264125a50d5
- MD5 SHA1 SHA512
Score

8^/10
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral13 behavioral14
- Target
  2023-10-12-shortcut-for-DarkGate-example-2-of-3.lnk.bin
- Size 2KB
- SHA256 4afbeb1589b96d9e1c3bf88ef1e528a87c6d580092d7552db53819e503ab2458
- MD5 a063f1acabd5c2d24f70704e913f5418
- SHA1 c89ed740ed15d9156c3a80788aeb18b6aae3829c
- SHA512 7f8cd0de9d9766905729afd5012a17527a889dc4c2f857bd63c89c5734865b5b3bb35d77bd19c7c85e68e714b658bd9f7e08491d12be0d38c7cc8ed65c1041d7
- MD5 SHA1 SHA512
Score

8^/10
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral15 behavioral16
- Target
  2023-10-12-shortcut-for-DarkGate-example-3-of-3.lnk.bin
- Size 2KB
- SHA256 7b03a759123dbb2429e1e7a506e5281b3ecc0d4a655bf5affc3650f9d8e20a24
- MD5 51c988eafe2438f261d7f6d9711b309d
- SHA1 61254f808d734b3782cf23412d478cb131dccc74
- SHA512 8a096a8fa53a0d419ae5bd93767e1d32b3f1f851a40298c4ae4b667ab366f37fccb88f6ce60eff8e204fd8106312feae6826429c4965721bb58026070a7f36d2
- MD5 SHA1 SHA512
Score

8^/10
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral17 behavioral18

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect DarkGate stealer

Suspicious use of NtCreateUserProcessOtherParentProcess

Blocklisted process makes network request

Checks computer location settings

Blocklisted process makes network request

Checks computer location settings

Blocklisted process makes network request

Checks computer location settings

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18