darkgate | zipzip[.]zip

resource	yara_rule
static1/unpack002/2023-10-12-decoded-EXE-retrieved-by-au3-script.bin	family_darkgate_v6

resource
unpack002/2023-10-12-decoded-EXE-retrieved-by-au3-script.bin

zipzip.zip

SHA256 329db242a00f0dcf4e2f6390b06c837fd992cabb2cc4d0eda8278a8c57d4b044
MD5 235330b79839fb8eec4c68810166747b
SHA1 c952e921afe299842df337c4ae084ca8916fbed4
SHA512 07ce5e7bd45e4af12d360937d6ca1a1840fe7b8fbe8486b366156cd8263b4c218c2a5767a237a7b1a14dc20ad1c348c4fcf0ed8f983314ae5f96e8fb88de366f
SSDEEP 12288:XGGToXqB1GfnYUI7i19s5uOAacotvkDc1HZ56gWDz92/tEKtXid:XGGkVAUI729Iupots+ADRKpid
MD5 SHA1 SHA512 SSDEEP

Password

infected

3e08210a4220601751bef08b860cbdeb3029c36ffbf8858b3d433b29f5854ecd

SHA256 3e08210a4220601751bef08b860cbdeb3029c36ffbf8858b3d433b29f5854ecd
MD5 e0b04cc2dbd053eec0aa8ea7f4ebf6a5
SHA1 2f0c7444cf84d4888838eb21b2d7da6f9abc2b6b
SHA512 e202c1fe271557d3826c296a5cc13f2bd758b7c350bd381aca87c644c625c01a2b1adc103fa82c37a53026a70d27c8f4a7bd1dfe08bb17fceadfb5d9479962b3
SSDEEP 12288:ZBkNKvs7O+4OBOxj/nBWsgyZG9Mq/btiHkxcPzXbF9rJiW2:XkN4+41nBRTZG9M2AHF9rc
MD5 SHA1 SHA512 SSDEEP

Password

infected

2023-10-12-AutoIt-script-file-for-DarkGate-example-1-of-3.au3

SHA256 c01d186f412fac04b0b80c6242c378ee00d1c63affb83d44ee75f65a08f4e966
MD5 1d9e64a4fb4eddc87df990d8e9be6cae
SHA1 1b6bbc58d0153247e418bd2cb6665057601ff075
SHA512 16cb48892e0effafe0f643f7736fa44aeed8f653dc2558ceab3c4eb95132b5e67c3eebc47af9dcddc2cfd4a2e04278fc5c651590f2bb3fe5baacc3a85bdfca64
SSDEEP 96:LAQ3RilxfVyAEHp2VJpqL6zZmq2Cws+2J6uXA+srR/6kdUWot1KTDi8xxLtc7IS2:c12LJ56MHLunqVLtynAU2n4VY7E3wJ
MD5 SHA1 SHA512 SSDEEP

2023-10-12-AutoIt-script-file-for-DarkGate-example-2-of-3.au3

SHA256 d841110e05dc8970c1f96ec038ff98a4f463c2b5e96d114a84e4c3bb97628797
MD5 6d9d11d08feae9b76c114ad71e2ff557
SHA1 02dc6cc3b5b35295d2f826f83dd0cb07c3398ba5
SHA512 00edbf73cffa59db36c55922a5a52e2b51d45ae488d836304ae83f14a406db64cc7a629b95b50f2575e21bdbd6f1b0639660f5af01b10333cf2220951f0f03ed
SSDEEP 192:12SwsOtdDs2rfRn4kkKRALLfgmguAsF222DdtXZ:nolsmZAKRAvfgmguAsmD3Z
MD5 SHA1 SHA512 SSDEEP

2023-10-12-AutoIt-script-file-for-DarkGate-example-3-of-3.au3

SHA256 c786fba049049139859c8d552f957780628b437c11af0720c0c13481897b7244
MD5 d46ba051ead139b4db7584becbe9ca7b
SHA1 582a056fe75f1a375c56c976cefd32063e26633f
SHA512 ac74fed64b8ecb48fe860630cb97e16da1133876510304c56340bc451c46d91cbba236eed9d29dd858e544adab74e010821e6f560b03dfe083f4fe6077198cca
SSDEEP 192:GbHNdPlw5g+k4Vv5//ReRuzvoN/zqqkFYvD//gdCWaSH:wdPkg+1hBnvoNrqqkFY800H
MD5 SHA1 SHA512 SSDEEP

2023-10-12-DarkGate-IOCs.txt

SHA256 6dceda97bd6fca9f4b77f397883cc362562f618d90514e41fa360d53e838f607
MD5 92e3ec320e60e76b800de5899ee86915
SHA1 91e6e9876fb9ef8b7aa4d3a540abd1c108419b43
SHA512 224e538a03b4733b00628fdbc011888f2afaaded7f79636c760d46f46153a9a3c0eebee337e3002a5e49ce78dc265ffc83660218a1a843e584679463da3b3e67
SSDEEP 96:P4mEjI4DQCKliWc2O2FOOyuFOOykXE0YbnTVxDiJdfMwbZb:uHoiW/AhuAhkXDYz2dfnbZb
MD5 SHA1 SHA512 SSDEEP

2023-10-12-decoded-EXE-retrieved-by-au3-script.bin

SHA256 7fc3126b9c53816657076b62188f9905067ec4b070deea5999cd6d7aa3c85c76
MD5 d90f88cd13ddbd5273133dc5fc062f19
SHA1 c7161197ef24a856106abc8b5c1946b6a51e686c
SHA512 944295a3a87fa34a90a1f7450d015e5c0d81ea9dcaf02e1e3a3880f1e8a240e9a89b8eb08a3776f90ac0dccd9e9bccf547c63628d240c05cfc94ac55b9170a90
SSDEEP 6144:s50tl7kAfri5ZhtWtIv9n0YQFaVfTnU6UVtmSaq1nMyCC3gT2Pt:a0tlBi5ZhtWtIv50genz91n1CC3j
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Detect DarkGate stealer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

341092

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

331KB

Virtual Size

330KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

12B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

2023-10-12-encoded-binary-retrieved-by-au3-script.bin

SHA256 307e554435ba5edc9c2b1d11e940d5656f748bd399465ae05dfc4a40e30a363f
MD5 428a589184fdee0acc2906261fa0c579
SHA1 cae63c6f8fbfedfa59c50e06881371209b1b4171
SHA512 ee513cf78a115224a2650fdc22a87102da96ea5e573e296908bbeb636e9f33675ef3bbe9707239548d0cc028043c64ab1112e52ddd6c28b12dfbf6924d604514
SSDEEP 12288:6mK3FJgNdwR8mNaR3Ntc0fYlP28FmihtI:7K3FUi8mNOt1fYM8he
MD5 SHA1 SHA512 SSDEEP

2023-10-12-password-protected-zip-archive-for-DarkGate-example-1-of-4.zip

SHA256 36bc501e5fb8520c1b713d70251424fa484f045abbb205682ff445f46f3d1201
MD5 1624a5990c6508b7a5991a39285b5635
SHA1 1590ea73348dc2a4be3878fa9da1e91ff7b56cf3
SHA512 fd6c7960063089e5ff65435a7ace44b4eaf447a50834c54ac64ab66b9262759353644db37f971c15c83bd4cb111b122b8446819b4c6098e36650802338ae927f
SSDEEP 192:CP31lFtCusnUKtU6pqjeKIhwPMziAYl0E6uI0ESQrZryhDD7:Cv1lGuKNpq6NriAYBcrZryhDD7
MD5 SHA1 SHA512 SSDEEP

2023-10-12-password-protected-zip-archive-for-DarkGate-example-2-of-4.zip

SHA256 4877106143a7fc8871614f2e19c51e9f7f4ff77ed5990881c9714422d3cb4c0b
MD5 90452e8bf7846975f76391148a350422
SHA1 758e831300482b150035ef097d6edeb7201f2619
SHA512 27739dc471b85136f6a924f1a8ab1b9600a28ccbbcb284a85266b05e550eca31773b970a3df07845a23ea7dbb6ee3dd82a9f1e9ee1cb146a8fa2aadd2a1db1b2
SSDEEP 192:CSaMWtI5Ya0dDFkrr38kxlZIQ6QuP4FfrZryhDD7:CSaMWt9VtFkrrsquP4RrZryhDD7
MD5 SHA1 SHA512 SSDEEP

2023-10-12-password-protected-zip-archive-for-DarkGate-example-3-of-4.zip

SHA256 73d2a8c1ba0860fef33ff46da8880ceb00c6a355a6bba14758be83fc17c845ab
MD5 dc922ee3c186ad60fd452d3104d69358
SHA1 272f26f2843d45de0f8ed97e08921c1f19a9697c
SHA512 53e1960f1ecc52b9e244e38e9a03d6fd295154b62d519144944514b2a8a0264a088335fcd3b28e763a41de6f315376a9f1afc78e916194f0a46c2e0c4196699c
SSDEEP 192:+ttfBsAQP8BeEjciJU7GUYejTE8kXykF0WmL:+ttiPZ4cSU7/jTENXpFcL
MD5 SHA1 SHA512 SSDEEP

2023-10-12-password-protected-zip-archive-for-DarkGate-example-4-of-4.zip

SHA256 8fa71bb4079780710ca354a312f5a887fe7bd9f3a744e43c19f5eb87aed65c0f
MD5 6267a487b7cefac421eb307a73f49d6b
SHA1 b5afdabdfe4fa446d823512a36069b6a2a8e025c
SHA512 e272b01939ca296b049d5aa3dd17c7f887bbf10d312d3129e58efaeb11599740d24d96c7626b834cb3c9a7c93e249ce2713f15efb797bdeb975ab5a5e69490f1
SSDEEP 96:sqvDrsCxCv4oOOOAdp6WZNds+A5w9CIw9UsQvZCdLm+JDqbrCMNrzwymEOO+E:VrsCGMFOhjA5w9Caj4dLNJ41znm7LE
MD5 SHA1 SHA512 SSDEEP

2023-10-12-shortcut-for-DarkGate-example-1-of-3.lnk.bin

SHA256 ba18f678b08580795416148d2bba5b0a0b7be4c85b8501a28f49c8141268ec57
MD5 dfc6cf8b82837441164308af04c3884f
SHA1 36bcadb22fe93caf76fc5c68210f33eb8c7df0c0
SHA512 1f8d89eeb4d082ab17a31085de46901acd5a9cccabb71e8fc2d0ac7ba798e81ef6a5a9433289cac660d01eb673caa82a656d85aa6dc49ad441b23264125a50d5
MD5 SHA1 SHA512

2023-10-12-shortcut-for-DarkGate-example-2-of-3.lnk.bin

SHA256 4afbeb1589b96d9e1c3bf88ef1e528a87c6d580092d7552db53819e503ab2458
MD5 a063f1acabd5c2d24f70704e913f5418
SHA1 c89ed740ed15d9156c3a80788aeb18b6aae3829c
SHA512 7f8cd0de9d9766905729afd5012a17527a889dc4c2f857bd63c89c5734865b5b3bb35d77bd19c7c85e68e714b658bd9f7e08491d12be0d38c7cc8ed65c1041d7
MD5 SHA1 SHA512

2023-10-12-shortcut-for-DarkGate-example-3-of-3.lnk.bin

SHA256 7b03a759123dbb2429e1e7a506e5281b3ecc0d4a655bf5affc3650f9d8e20a24
MD5 51c988eafe2438f261d7f6d9711b309d
SHA1 61254f808d734b3782cf23412d478cb131dccc74
SHA512 8a096a8fa53a0d419ae5bd93767e1d32b3f1f851a40298c4ae4b667ab366f37fccb88f6ce60eff8e204fd8106312feae6826429c4965721bb58026070a7f36d2
MD5 SHA1 SHA512

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

zipzip.zip

3e08210a4220601751bef08b860cbdeb3029c36ffbf8858b3d433b29f5854ecd

2023-10-12-AutoIt-script-file-for-DarkGate-example-1-of-3.au3

2023-10-12-AutoIt-script-file-for-DarkGate-example-2-of-3.au3

2023-10-12-AutoIt-script-file-for-DarkGate-example-3-of-3.au3

2023-10-12-DarkGate-IOCs.txt

2023-10-12-decoded-EXE-retrieved-by-au3-script.bin

generic

2023-10-12-encoded-binary-retrieved-by-au3-script.bin

2023-10-12-password-protected-zip-archive-for-DarkGate-example-1-of-4.zip

2023-10-12-password-protected-zip-archive-for-DarkGate-example-2-of-4.zip

2023-10-12-password-protected-zip-archive-for-DarkGate-example-3-of-4.zip

2023-10-12-password-protected-zip-archive-for-DarkGate-example-4-of-4.zip

2023-10-12-shortcut-for-DarkGate-example-1-of-3.lnk.bin

2023-10-12-shortcut-for-DarkGate-example-2-of-3.lnk.bin

2023-10-12-shortcut-for-DarkGate-example-3-of-3.lnk.bin