Extracted

• • Target

    march-D9445-2024.xlsx

  • Size

    60KB

  • MD5

    ac89528d1040074d45d5c19a0ceb7a6a

  • SHA1

    8b47dba91232a0e1ac14cee24267e9c26d7e483c

  • SHA256

    1d67808fee7115fa2597e8843aa10f737298c9f097397e5de486fc762753ea0b

  • SHA512

    37da11cea5188cc7b7f6c9154410d9d663d5ed306313badbaa421025c49f90bff177613a132d2bff1b529ec214d9eb034937ab8d7830d30bd4451f1579a27feb

  • SSDEEP

    1536:64N5DGhJDl5eZ9l0ohOplRfzDrtw86RUtdkV:643ChJR0vl0ohYlRfzD/6o2

  Score

  10^/10

  darkgateadmin888stealer

  • DarkGate

    DarkGate is an infostealer written in C++.

    stealerdarkgate

  • Detect DarkGate stealer

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral1behavioral2