Overview

overview

10

Static

static

1

6e068b9dcd...70.msi

windows7-x64

10

6e068b9dcd...70.msi

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6e068b9dcd8df03fd6456faeb4293c036b91a130a18f86a945c8964a576c1c70.zip

  • Size

    998KB

  • Sample

    240402-lv4keadf84

  • MD5

    fc08d0ee71af8516236641702d95a061

  • SHA1

    557fcb33bb7fec101e6255273b46a2ff895c06e5

  • SHA256

    213ca933aac2c1d8185f0aeeac48d2c82fbfe0dbfb5d42688f890634c2feaa53

  • SHA512

    e5f1bdbc89afdab31f04c90046372de908f45613219c42221b3f73d3ffc9c9ce7ce6c20a3a71d376b613f2fb1a2e01ddba3752088a659fdc3af956337c96420b

  • SSDEEP

    24576:TDMv9iIImNNkkp4gxtPpEKViQOU5VgYEUvLCV1dRK4ulesU4D:/M1Hkkp4yvNVDOagYE0GdRKDAsUQ

Score
10/10
darkgatediscoverystealer

Malware Config

Extracted

Family

darkgate

C2

http://80.66.88.145

Attributes
  • anti_analysis

    false

  • anti_debug

    false

  • anti_vm

    false

  • c2_port

    7891

  • check_disk

    true

  • check_ram

    true

  • check_xeon

    false

  • crypter_au3

    true

  • crypter_dll

    false

  • crypter_raw_stub

    false

  • crypto_key

    bIWRRCGvGiXOga

  • internal_mutex

    bbbGcB

  • minimum_disk

    50

  • minimum_ram

    4096

  • ping_interval

    4

  • rootkit

    true

  • startup_persistence

    true

Targets

    • Target

      6e068b9dcd8df03fd6456faeb4293c036b91a130a18f86a945c8964a576c1c70.msi

    • Size

      1.8MB

    • MD5

      247a8cc39384e93d258360a11381000f

    • SHA1

      23893f035f8564dfea5030b9fdd54120d96072bb

    • SHA256

      6e068b9dcd8df03fd6456faeb4293c036b91a130a18f86a945c8964a576c1c70

    • SHA512

      336eca9569c0072e92ce16743f47ba9d6be06390a196f8e81654d6a42642ff5c99e423bfed00a8396bb0b037d5b54df8c3bde53757646e7e1a204f3be271c998

    • SSDEEP

      24576:ftncpVGP4I9FsEsyt8l+E+s1tB7parWM0+AL5QgZQvUXtAqlU0ZyMRp:epUP59FBJZEH1X1arF0vN/nX

    Score
    10/10
    darkgatediscoverystealer

    • DarkGate

      DarkGate is an infostealer written in C++.

      stealerdarkgate

    • Detect DarkGate stealer

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Drops startup file

    • Modifies file permissions

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks