General

  • Target

    dark_drop.exe

  • Size

    1.4MB

  • Sample

    240329-q8qmxsaa4s

  • MD5

    86fa1c9350bd54a32202d47f35e7f9a6

  • SHA1

    40243988b97eb12450e3c73f8787ca8e3866a993

  • SHA256

    128d1a417bc1c7258c505ffd1a250366f37d0074c44b08a10ef3e9accb57f56b

  • SHA512

    916dc6626ab253f03cbf9a02e462d91ff8795ba00940469e53a26369e924d87b3db6f5b9ca744bef342fe95a964b6338b03ff19b126e68162d1872fb2a64218a

  • SSDEEP

    24576:cnT3E53Myyzl0hMf1tr7Caw8M0fYnejlgFYel36NG5ADcYz/V2sksJZx/Q:cT3EZpBh211Waw30wncloYel36NeMF2x

Malware Config

Extracted

Family

darkgate

Botnet

kaitoshiba123

C2

45.63.52.184

Attributes
  • anti_analysis

    true

  • anti_debug

    false

  • anti_vm

    true

  • c2_port

    8094

  • check_disk

    false

  • check_ram

    false

  • check_xeon

    false

  • crypter_au3

    false

  • crypter_dll

    false

  • crypter_raw_stub

    false

  • internal_mutex

    EhuJByqk

  • minimum_disk

    100

  • minimum_ram

    4096

  • ping_interval

    6

  • rootkit

    false

  • startup_persistence

    true

  • username

    kaitoshiba123

Targets

    • Target

      dark_drop.exe

    • Size

      1.4MB

    • MD5

      86fa1c9350bd54a32202d47f35e7f9a6

    • SHA1

      40243988b97eb12450e3c73f8787ca8e3866a993

    • SHA256

      128d1a417bc1c7258c505ffd1a250366f37d0074c44b08a10ef3e9accb57f56b

    • SHA512

      916dc6626ab253f03cbf9a02e462d91ff8795ba00940469e53a26369e924d87b3db6f5b9ca744bef342fe95a964b6338b03ff19b126e68162d1872fb2a64218a

    • SSDEEP

      24576:cnT3E53Myyzl0hMf1tr7Caw8M0fYnejlgFYel36NG5ADcYz/V2sksJZx/Q:cT3EZpBh211Waw30wncloYel36NeMF2x

    • DarkGate

      DarkGate is an infostealer written in C++.

    • Detect DarkGate stealer

    • Executes dropped EXE

MITRE ATT&CK Enterprise v15

Tasks