Overview

overview

10

Static

static

1

scan-28-02...6.xlsx

windows7-x64

1

scan-28-02...6.xlsx

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    scan-28-02-24_3136.xlsx

  • Size

    29KB

  • Sample

    240228-s94bhsfd8y

  • MD5

    9d51efbfb3733f9e41a3ca833eecd843

  • SHA1

    bfb4462b184d7cde4d382dd4104b721ac4b4ab8f

  • SHA256

    abadc5f79d85d395c7760c93d635c885f4ea7cdf872986332c650ffbf2ad9984

  • SHA512

    955a1d6a7173dcac1d44374923530ca106d83afd7aa24b0aecd246b83d7cc94ea88b26f858717db858ef987769c1152ef79e18674c36699de3eca305519cbfa8

  • SSDEEP

    768:wnEQpllh7tAafroiianGoHoJ+yWWn0WhtEk:nQJh7Lro4ntD+0AEk

Score
10/10
darkgateadmin888stealer

Malware Config

Extracted

Family

darkgate

Botnet

admin888

C2

cayennesxque.boo

Attributes
  • anti_analysis

    true

  • anti_debug

    false

  • anti_vm

    true

  • c2_port

    80

  • check_disk

    false

  • check_ram

    false

  • check_xeon

    false

  • crypter_au3

    false

  • crypter_dll

    false

  • crypter_raw_stub

    false

  • internal_mutex

    HwHLLNLY

  • minimum_disk

    50

  • minimum_ram

    7000

  • ping_interval

    6

  • rootkit

    false

  • startup_persistence

    true

  • username

    admin888

Targets

    • Target

      scan-28-02-24_3136.xlsx

    • Size

      29KB

    • MD5

      9d51efbfb3733f9e41a3ca833eecd843

    • SHA1

      bfb4462b184d7cde4d382dd4104b721ac4b4ab8f

    • SHA256

      abadc5f79d85d395c7760c93d635c885f4ea7cdf872986332c650ffbf2ad9984

    • SHA512

      955a1d6a7173dcac1d44374923530ca106d83afd7aa24b0aecd246b83d7cc94ea88b26f858717db858ef987769c1152ef79e18674c36699de3eca305519cbfa8

    • SSDEEP

      768:wnEQpllh7tAafroiianGoHoJ+yWWn0WhtEk:nQJh7Lro4ntD+0AEk

    Score
    10/10
    darkgateadmin888stealer

    • DarkGate

      DarkGate is an infostealer written in C++.

      stealerdarkgate

    • Detect DarkGate stealer

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks