Extracted

• • Target

    8b170beb34d161b7991fad512708e86d76f61966b97b06c25f2fa63ca1e85aaa.xlsx

  • Size

    60KB

  • MD5

    ac17fd450a0951be064e074ba95bb35a

  • SHA1

    d3fc019079761d0228f802f6d54314b093587c98

  • SHA256

    8b170beb34d161b7991fad512708e86d76f61966b97b06c25f2fa63ca1e85aaa

  • SHA512

    b8461a875edaa6e7a3e8c865f7c376d84303643d1a3c6a9bb8c165ed7c093bdbfa3208be3f70c7292ff1d4b2ebe69ac099dcfb6f1592f1ec6f217ee50932983d

  • SSDEEP

    1536:cIN5DGhJDl5eZ9l0ohOplRfzDrtw86RUtdP:cI3ChJR0vl0ohYlRfzD/6oF

  Score

  10^/10

  darkgateadmin888stealer

  • DarkGate

    DarkGate is an infostealer written in C++.

    stealerdarkgate

  • Detect DarkGate stealer

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Drops desktop.ini file(s)

  behavioral1behavioral2