Extracted

• • Target

    march19-D1482-2024.xlsx

  • Size

    56KB

  • MD5

    58bd1ea09bb663ead5492e2a43b6fb77

  • SHA1

    0a3d7f905e00973c05d51b60036838acab9d723b

  • SHA256

    efb106418264f96ba251321a5c3ed8a191e3b8123f647d4ccf8c08d5447d03f6

  • SHA512

    b82605a87c50e1d7d662e98ba2aeac1e540affddaec8628c8c491b194469a834d8bffd876a78ea6719e92f59e0e219f4f681a739e15ce381e63d9534ca43570a

  • SSDEEP

    1536:Fkws9oLE3Ow6DyPgMUti9xx7bxNfI5ydaRLgIui3pqDyBROnlTP:FSoEOfEgMNdxI5yYhgu5zBRYr

  Score

  10^/10

  darkgateadmin888stealer

  • DarkGate

    DarkGate is an infostealer written in C++.

    stealerdarkgate

  • Detect DarkGate stealer

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral1behavioral2