Overview

overview

10

Static

static

1

scripted.txt

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    scripted.txt

  • Size

    512B

  • Sample

    240319-r9q6hsef52

  • MD5

    24527471078aa62be9cef333ab5458ab

  • SHA1

    37733ee9cb177a7e95e132544a944fa0d32ffb9f

  • SHA256

    9b2be97c2950391d9c16497d4362e0feb5e88bfe4994f6d31b4fda7769b1c780

  • SHA512

    bf58604bc6aeacb2241aa05746951692e7775a142f7b962af7d7012673b6ba43b361e161f9cd768e6dea101b8c2120f65068c5cdb640c02f5be3cc4343f19c02

Score
10/10
darkgateadmin888stealer

Malware Config

Extracted

Family

darkgate

Botnet

admin888

C2

diveupdown.com

Attributes
  • anti_analysis

    true

  • anti_debug

    false

  • anti_vm

    true

  • c2_port

    80

  • check_disk

    false

  • check_ram

    false

  • check_xeon

    false

  • crypter_au3

    false

  • crypter_dll

    false

  • crypter_raw_stub

    false

  • internal_mutex

    VfiPBBhr

  • minimum_disk

    50

  • minimum_ram

    4000

  • ping_interval

    6

  • rootkit

    false

  • startup_persistence

    true

  • username

    admin888

Targets

    • Target

      scripted.txt

    • Size

      512B

    • MD5

      24527471078aa62be9cef333ab5458ab

    • SHA1

      37733ee9cb177a7e95e132544a944fa0d32ffb9f

    • SHA256

      9b2be97c2950391d9c16497d4362e0feb5e88bfe4994f6d31b4fda7769b1c780

    • SHA512

      bf58604bc6aeacb2241aa05746951692e7775a142f7b962af7d7012673b6ba43b361e161f9cd768e6dea101b8c2120f65068c5cdb640c02f5be3cc4343f19c02

    Score
    10/10
    darkgateadmin888stealer

    • DarkGate

      DarkGate is an infostealer written in C++.

      stealerdarkgate

    • Detect DarkGate stealer

    • Blocklisted process makes network request

    • Executes dropped EXE

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks