Extracted

• • Target

    march19-D3145-2024[1314225].xlsx

  • Size

    56KB

  • MD5

    60d07f9e7daf81bb5a9bb4b3bed41bfd

  • SHA1

    2757c793b96639f3bca33bdd07576d3ad95d063b

  • SHA256

    2766eeb9422ef9dccc1f208e7cbb807c57decae2b08d82995aaf897a67583c94

  • SHA512

    a90b3a0d6af36d1b404d687d71b8d59f234129cfefe972381af5479c4501cf2d513b7131c4107a7a0ab45d4a5722f7e0854e5ff52578b4bcfcdaae8dc5c49a45

  • SSDEEP

    1536:Fkws9oLE3Ow6DyPgMUti9xx7bxNfI5ydaRLgIui3pqDyBROnlTE:FSoEOfEgMNdxI5yYhgu5zBRYg

  Score

  10^/10

  darkgateadmin888stealer

  • DarkGate

    DarkGate is an infostealer written in C++.

    stealerdarkgate

  • Detect DarkGate stealer

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral1behavioral2