Overview

overview

10

Static

static

1

scan-28-02...2.xlsx

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    scan-28-02-24_4822.xlsx

  • Size

    29KB

  • Sample

    240228-wcpcwaaa9t

  • MD5

    ae47390eb1b35abd3004221b885f5bad

  • SHA1

    b0dae6ce8c37c7a24b39dfb00c6fa326746436c0

  • SHA256

    ad29697a7630a389d8f1476989c0cbd960dd33822e3c8e03fc75a2fbe271d8ab

  • SHA512

    baf115866cccbfdc02c30991c23e1267e8964058d20301b1a27a5dc6b495814d7208d589ed1d7fe838235eca200c5fc39a6571ca84436d8be4e83e11c61e51fd

  • SSDEEP

    768:wnEQpllh7tAafroiianGoHoJ+yWWn0Wht7oK:nQJh7Lro4ntD+0A0K

Score
10/10
darkgateadmin888stealer

Malware Config

Extracted

Family

darkgate

Botnet

admin888

C2

cayennesxque.boo

Attributes
  • anti_analysis

    true

  • anti_debug

    false

  • anti_vm

    true

  • c2_port

    80

  • check_disk

    true

  • check_ram

    false

  • check_xeon

    false

  • crypter_au3

    false

  • crypter_dll

    false

  • crypter_raw_stub

    false

  • internal_mutex

    ekoRFSqn

  • minimum_disk

    50

  • minimum_ram

    7000

  • ping_interval

    6

  • rootkit

    false

  • startup_persistence

    true

  • username

    admin888

Targets

    • Target

      scan-28-02-24_4822.xlsx

    • Size

      29KB

    • MD5

      ae47390eb1b35abd3004221b885f5bad

    • SHA1

      b0dae6ce8c37c7a24b39dfb00c6fa326746436c0

    • SHA256

      ad29697a7630a389d8f1476989c0cbd960dd33822e3c8e03fc75a2fbe271d8ab

    • SHA512

      baf115866cccbfdc02c30991c23e1267e8964058d20301b1a27a5dc6b495814d7208d589ed1d7fe838235eca200c5fc39a6571ca84436d8be4e83e11c61e51fd

    • SSDEEP

      768:wnEQpllh7tAafroiianGoHoJ+yWWn0Wht7oK:nQJh7Lro4ntD+0A0K

    Score
    10/10
    darkgateadmin888stealer

    • DarkGate

      DarkGate is an infostealer written in C++.

      stealerdarkgate

    • Detect DarkGate stealer

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks