Extracted

• • Target
    hunter.lnk
  • Size 1KB
  • SHA256 6925e726c6e7925d89d6b64538e98ea294d11da7d9904e4a2fd2825553ea5024
  • MD5 e8276f2d1e0d01c035019d8ffebfa2e6
  • SHA1 7da2a87e768f8f35c57681561e3bfe1111d95b5c
  • SHA512 89027286ff1a26f07618b0541b49f963e70e60a3ef87a651334e5eb365eeeb049c467495068ec5a840703e59e2da5c218a1a10f1825daf076a84ab854d30ff17
  • MD5 SHA1 SHA512

  Score

  10^/10

  darkgatestealer

  • DarkGate

    DarkGate is an infostealer written in C++.

    stealerdarkgate

  • Detect DarkGate stealer

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1