Overview

overview

10

Static

static

1

356046c5af...6.xlsx

windows7-x64

1

356046c5af...6.xlsx

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    356046c5af6ac3b209ff92daa9d12a549846cdd5556fc20296d4d73384f7a8f6.xlsx

  • Size

    56KB

  • Sample

    240320-amc7pscc4y

  • MD5

    d2c56b42e6814069b4a9e9cb0aa67e00

  • SHA1

    11ba553e5d38d1091dc62c528487704d7e239a45

  • SHA256

    356046c5af6ac3b209ff92daa9d12a549846cdd5556fc20296d4d73384f7a8f6

  • SHA512

    d85a7609c44f297da8f042e9ecfa9b705a547a88d9793152f6be830b83227d9fce5985db3835a82563f99c8b3f21a1655cf6bd2d4904a3bfb6c9d614965e9130

  • SSDEEP

    1536:Fkws9oLE3Ow6DyPgMUti9xx7bxNfI5ydaRLgIui3pqDyBROnlTx:FSoEOfEgMNdxI5yYhgu5zBRY1

Score
10/10
darkgateadmin888stealer

Malware Config

Extracted

Family

darkgate

Botnet

admin888

C2

badbutperfect.com

Attributes
  • anti_analysis

    true

  • anti_debug

    false

  • anti_vm

    true

  • c2_port

    80

  • check_disk

    false

  • check_ram

    false

  • check_xeon

    false

  • crypter_au3

    false

  • crypter_dll

    false

  • crypter_raw_stub

    false

  • internal_mutex

    WZqqpfdY

  • minimum_disk

    50

  • minimum_ram

    4000

  • ping_interval

    6

  • rootkit

    false

  • startup_persistence

    true

  • username

    admin888

Targets

    • Target

      356046c5af6ac3b209ff92daa9d12a549846cdd5556fc20296d4d73384f7a8f6.xlsx

    • Size

      56KB

    • MD5

      d2c56b42e6814069b4a9e9cb0aa67e00

    • SHA1

      11ba553e5d38d1091dc62c528487704d7e239a45

    • SHA256

      356046c5af6ac3b209ff92daa9d12a549846cdd5556fc20296d4d73384f7a8f6

    • SHA512

      d85a7609c44f297da8f042e9ecfa9b705a547a88d9793152f6be830b83227d9fce5985db3835a82563f99c8b3f21a1655cf6bd2d4904a3bfb6c9d614965e9130

    • SSDEEP

      1536:Fkws9oLE3Ow6DyPgMUti9xx7bxNfI5ydaRLgIui3pqDyBROnlTx:FSoEOfEgMNdxI5yYhgu5zBRY1

    Score
    10/10
    darkgateadmin888stealer

    • DarkGate

      DarkGate is an infostealer written in C++.

      stealerdarkgate

    • Detect DarkGate stealer

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks