darkgate | c36f35e271e0e7c345ca701c782605a2f899aa6f30f13d06ab7541244c8a8229[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
c36f35e271e0e7c345ca701c782605a2f899aa6f30f13d06ab7541244c8a8229.zip
Size 193KB
Sample240402-l641baec31
SHA256 38c2831d236cca17e7a907073eb60c718ca0ab35cbaf71bc63bf8d45b74deb2b
MD5 d913f0f2e2905fb8029d6e0ac804d43d
SHA1 88999854ba2a703fc17e72fb11907772b9f55b49
SHA512 f37393c4dd3613e8992db4f809154cdd6ebe6e95668ae72326d9a7ad2b641aba99bb28f79b8c71896eb1a32c4a73b0b959da2fa02437751ded36405798ab1d97
SSDEEP 6144:Jrexotjn/ZkddkO+HQn4zF6rVkkNspShb:JyK1xkYO+HQnNZ9sQ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

civilian1337 darkgate

Malware Config

Extracted

Family

darkgate

Version

5.2.4

Botnet

civilian1337

http://185.130.227.202

Attributes

alternative_c2_port
8080
anti_analysis
false
anti_debug
true
anti_vm
false
c2_port
2351
check_disk
false
check_ram
false
check_xeon
false
crypter_au3
false
crypter_dll
false
crypter_raw_stub
true
crypto_key
VPsTDMdPronzYs
internal_mutex
txtMut
minimum_ram
4096
ping_interval
4
rootkit
true
startup_persistence
true
username
civilian1337

Signatures

Darkgate family
darkgate

Detect DarkGate stealer 1 IoCs

resource	yara_rule
static1/unpack001/c36f35e271e0e7c345ca701c782605a2f899aa6f30f13d06ab7541244c8a8229.exe	family_darkgate_v6

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/c36f35e271e0e7c345ca701c782605a2f899aa6f30f13d06ab7541244c8a8229.exe

File Explorer

c36f35e271e0e7c345ca701c782605a2f899aa6f30f13d06ab7541244c8a8229.zip

.zip 193KB
c36f35e271e0e7c345ca701c782605a2f899aa6f30f13d06ab7541244c8a8229.exe

.exe 405KB

c36f35e271e0e7c345ca701c782605a2f899aa6f30f13d06ab7541244c8a8229.zip

SHA256 38c2831d236cca17e7a907073eb60c718ca0ab35cbaf71bc63bf8d45b74deb2b
MD5 d913f0f2e2905fb8029d6e0ac804d43d
SHA1 88999854ba2a703fc17e72fb11907772b9f55b49
SHA512 f37393c4dd3613e8992db4f809154cdd6ebe6e95668ae72326d9a7ad2b641aba99bb28f79b8c71896eb1a32c4a73b0b959da2fa02437751ded36405798ab1d97
SSDEEP 6144:Jrexotjn/ZkddkO+HQn4zF6rVkkNspShb:JyK1xkYO+HQnNZ9sQ
MD5 SHA1 SHA512 SSDEEP

Password

infected

c36f35e271e0e7c345ca701c782605a2f899aa6f30f13d06ab7541244c8a8229.exe

SHA256 c36f35e271e0e7c345ca701c782605a2f899aa6f30f13d06ab7541244c8a8229
MD5 52fc04a1017bff949d2531942491e7d9
SHA1 0f23ac4f5dc0603894374026349d7db0f870ee91
SHA512 920905dc5d7c25daf2ba38daeeeab8ffe883023905ecb166f585346b012caeb3629e12400ca0df4c24e23d2abdea8081f7272d3b1385121ffc301f2982a10c85
SSDEEP 12288:0UEpOEWzuYzy/Bda9AlxhwcySTcth/4N:0fOEWjyZda9uhwlSIf4
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Detect DarkGate stealer
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

333664

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

324KB

Virtual Size

324KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

c36f35e271e0e7c345ca701c782605a2f899aa6f30f13d06ab7541244c8a8229.zip

c36f35e271e0e7c345ca701c782605a2f899aa6f30f13d06ab7541244c8a8229.exe

generic