Extracted

• • Target

    march19-D7621-2024.xlsx

  • Size

    56KB

  • MD5

    78a0e98eb82f8101e07ee8e1217935e1

  • SHA1

    0dadb2a6df70848c840c2858b96f4ebead0356fe

  • SHA256

    0aae59e8b36fe2bbeb75e177702f3f44682b333fd6c751d355c1e796691fdd8c

  • SHA512

    8949b2aad7eeb68f0d32f5f60bb95c9c4bbb6312d279f3ebd4d862e7c9dea02721d18776cb955d6f5d52cfbe16644a5a231203f4749a8bdc355058bce925a191

  • SSDEEP

    1536:Fkws9oLE3Ow6DyPgMUti9xx7bxNfI5ydaRLgIui3pqDyBROnlTQ:FSoEOfEgMNdxI5yYhgu5zBRYc

  Score

  10^/10

  darkgateadmin888stealer

  • DarkGate

    DarkGate is an infostealer written in C++.

    stealerdarkgate

  • Detect DarkGate stealer

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral1behavioral2