darkgate | 3c64cbb7e7212d920322dae62665b05ceb63a0ad6074cac3ba518cedc5c6dd48[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
3c64cbb7e7212d920322dae62665b05ceb63a0ad6074cac3ba518cedc5c6dd48.zip
Size 218KB
Sample240402-l61b5aec2s
SHA256 074ccd1b26f0bc0cc2893d907916f29b9efdc9f53ebdaf1a6c27c65fe1b1bb4f
MD5 86027c5f447dc57e86c69dced4954eee
SHA1 9d9e9fae245b44a72309625d9de0a71c520447d2
SHA512 39459c4f2781d5609190fc1aa5f1581fc30c39c214ef2c5ad9b52d42c7211a9d75e0922c4963176b9282bd86243aef741e55ccf35aa98555f3f6acabf5581040
SSDEEP 6144:FTepQIHc02FHUlsy9Ec+uEh73PvJUY9hkfYjCZDTvR5xrqCPV5+:hrIlQHodEcPER/zhk0CZDVFPL+
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

admin8888 darkgate

Malware Config

Extracted

Family

darkgate

Botnet

admin8888

buassinnndm.net

Attributes

anti_analysis
true
anti_debug
false
anti_vm
true
c2_port
80
check_disk
false
check_ram
false
check_xeon
false
crypter_au3
false
crypter_dll
false
crypter_raw_stub
false
internal_mutex
losBHUAX
minimum_disk
100
minimum_ram
4096
ping_interval
6
rootkit
false
startup_persistence
true
username
admin8888

Signatures

Darkgate family
darkgate

Detect DarkGate stealer 1 IoCs

resource	yara_rule
static1/unpack001/3c64cbb7e7212d920322dae62665b05ceb63a0ad6074cac3ba518cedc5c6dd48.exe	family_darkgate_v6

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/3c64cbb7e7212d920322dae62665b05ceb63a0ad6074cac3ba518cedc5c6dd48.exe

File Explorer

3c64cbb7e7212d920322dae62665b05ceb63a0ad6074cac3ba518cedc5c6dd48.zip

.zip 218KB
3c64cbb7e7212d920322dae62665b05ceb63a0ad6074cac3ba518cedc5c6dd48.exe

.exe 454KB

3c64cbb7e7212d920322dae62665b05ceb63a0ad6074cac3ba518cedc5c6dd48.zip

SHA256 074ccd1b26f0bc0cc2893d907916f29b9efdc9f53ebdaf1a6c27c65fe1b1bb4f
MD5 86027c5f447dc57e86c69dced4954eee
SHA1 9d9e9fae245b44a72309625d9de0a71c520447d2
SHA512 39459c4f2781d5609190fc1aa5f1581fc30c39c214ef2c5ad9b52d42c7211a9d75e0922c4963176b9282bd86243aef741e55ccf35aa98555f3f6acabf5581040
SSDEEP 6144:FTepQIHc02FHUlsy9Ec+uEh73PvJUY9hkfYjCZDTvR5xrqCPV5+:hrIlQHodEcPER/zhk0CZDVFPL+
MD5 SHA1 SHA512 SSDEEP

Password

infected

3c64cbb7e7212d920322dae62665b05ceb63a0ad6074cac3ba518cedc5c6dd48.exe

SHA256 3c64cbb7e7212d920322dae62665b05ceb63a0ad6074cac3ba518cedc5c6dd48
MD5 2143d7603258b2801f7ed154b5da3da6
SHA1 5e9c26503ebac94a83b78a03057237ccce365a50
SHA512 061bdda42dd16812ae1ced3b4c9a9e99b600c7593f74397e4296e4b86386353fb8a0adfa8831d1c8f3fd98a7aa3550125f84ab88307808cdd50215ac210b9ebd
SSDEEP 12288:FtkKpKF2q1F3WbaPio/TKvJzghvOXK7BOYV:FtZA1F3WbaPio/OvJ09VUe
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Detect DarkGate stealer
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

375396

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

368KB

Virtual Size

368KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

3c64cbb7e7212d920322dae62665b05ceb63a0ad6074cac3ba518cedc5c6dd48.zip

3c64cbb7e7212d920322dae62665b05ceb63a0ad6074cac3ba518cedc5c6dd48.exe

generic