Overview

overview

10

Static

static

1

27032024_0...24.vbs

windows7-x64

3

27032024_0...24.vbs

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    27032024_0037_Report-26-2024.vbs

  • Size

    12KB

  • Sample

    240326-t4z8cahd7z

  • MD5

    b371387b0b5551c936c94bdf36c2e2f5

  • SHA1

    2f40590d998688bd681ea0afcea615b6a348cb31

  • SHA256

    038db3b838d0cd437fa530c001c9913a1320d1d7ac0fd3b35d974a806735c907

  • SHA512

    2c31bc7357c6b87b85cf44cedb9b864c6050544707a0f053121833ce677b99fa1094b2850b4ac73520e31b4804830d39f96ae506ae57f4fa7c49e9f04317b057

  • SSDEEP

    192:QMg119gkCtL3IqSPN3QzGNzUoNzhLnOdEpeLSHZgNdPR/Dnm9V4nN/Z/:Ly19gR3IquNgzG2oNdOdEpeeqlPxd

Score
10/10
darkgateadmin888stealer

Malware Config

Extracted

Family

darkgate

Botnet

admin888

C2

withupdate.com

Attributes
  • anti_analysis

    true

  • anti_debug

    false

  • anti_vm

    true

  • c2_port

    80

  • check_disk

    false

  • check_ram

    false

  • check_xeon

    false

  • crypter_au3

    false

  • crypter_dll

    false

  • crypter_raw_stub

    false

  • internal_mutex

    VqunyHFY

  • minimum_disk

    50

  • minimum_ram

    4000

  • ping_interval

    6

  • rootkit

    false

  • startup_persistence

    true

  • username

    admin888

Targets

    • Target

      27032024_0037_Report-26-2024.vbs

    • Size

      12KB

    • MD5

      b371387b0b5551c936c94bdf36c2e2f5

    • SHA1

      2f40590d998688bd681ea0afcea615b6a348cb31

    • SHA256

      038db3b838d0cd437fa530c001c9913a1320d1d7ac0fd3b35d974a806735c907

    • SHA512

      2c31bc7357c6b87b85cf44cedb9b864c6050544707a0f053121833ce677b99fa1094b2850b4ac73520e31b4804830d39f96ae506ae57f4fa7c49e9f04317b057

    • SSDEEP

      192:QMg119gkCtL3IqSPN3QzGNzUoNzhLnOdEpeLSHZgNdPR/Dnm9V4nN/Z/:Ly19gR3IquNgzG2oNdOdEpeeqlPxd

    Score
    10/10
    darkgateadmin888stealer

    • DarkGate

      DarkGate is an infostealer written in C++.

      stealerdarkgate

    • Detect DarkGate stealer

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks