Extracted

• • Target

    march19-D7526-2024.xlsx

  • Size

    56KB

  • MD5

    73adc9b2f25226f214f91ec8c2d413a8

  • SHA1

    39f8eab6c1d56fff2b3e6eddf56d8d544ccae9ae

  • SHA256

    a61448b1210aaaa33e398b1500701942ee2f4feb348420d628cc9d66974dfc31

  • SHA512

    2169548500a7364c53f7180ada02ecdc85601d7b743b5b40ce9ba330e6fa296489594fc02a443c18bb0381aa100892b791affe02319f89ba1cc3a8c55f37a53f

  • SSDEEP

    1536:Fkws9oLE3Ow6DyPgMUti9xx7bxNfI5ydaRLgIui3pqDyBROnlTF:FSoEOfEgMNdxI5yYhgu5zBRYx

  Score

  10^/10

  darkgateadmin888stealer

  • DarkGate

    DarkGate is an infostealer written in C++.

    stealerdarkgate

  • Detect DarkGate stealer

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral1behavioral2