Extracted

• • Target

    scanned_doc#2024-27-2_4065.xlsx

  • Size

    55KB

  • MD5

    c8d22d559dacad7baca08452fcc1d577

  • SHA1

    bb284b30a3d39019e4da6ec6d0d76a9bd0b879a7

  • SHA256

    1a147476f428a3e54505880bb38adb56b8b7dcf8e5d0d0312204396c41b81a1c

  • SHA512

    86fcca800930fd2f72d36d00b6695dda43966a2b26a1c86d5aa35a1d9e27927ff266bb5bb09e7fd46b5428fb5054f623f049ed7005b8d82055e5af71c86c4355

  • SSDEEP

    1536:p/ToOEjzAw7Y2r7DUsV4XzY9t3jSagJYwehV:BoOAcw7nXDUsOjm3jTxhV

  Score

  10^/10

  darkgateadmin888persistencestealer

  • DarkGate

    DarkGate is an infostealer written in C++.

    stealerdarkgate

  • Detect DarkGate stealer

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1