Extracted

• • Target

    06032024_0006_setup.js

  • Size

    32KB

  • MD5

    91129aacf3e4d87a776ca1ee9e358eb2

  • SHA1

    3e66e0e3eb6d17055ca1acca942c592141ad8261

  • SHA256

    e06efa3ff72da4a73045d31e888e001041a0e9058266d893fda525a90ab4e94c

  • SHA512

    975f722719311ebf1a6bee5f17b14e131bd613e955b2bee17401c5af864d08a68240748af08ccb9da957fe2565972339baade1534d0ad018e7a266ce469f0f34

  • SSDEEP

    768:rnJRkBVRaR9z6kNyRoRmG6o463cR4RenBRk6ORJRuRzRlnJRkBVRaR9z6kNyRoRx:rnJRkBVRaR9z6kNyRoRmG6o463cR4ReL

  Score

  10^/10

  darkgateadmin888davestealer

  • DarkGate

    DarkGate is an infostealer written in C++.

    stealerdarkgate

  • Detect DarkGate stealer

  • Blocklisted process makes network request

  • Dave packer

    Detects executable using a packer named 'Dave' by the community, based on a string at the end.

    dave

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2