darkgate | 3c64cbb7e7212d920322dae62665b05ceb63a0ad6074cac3ba518cedc5c6dd48[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
3c64cbb7e7212d920322dae62665b05ceb63a0ad6074cac3ba518cedc5c6dd48.zip
Size 218KB
Sample240402-qew8lsbb35
SHA256 1139c2997698f93629c269abadd593ecdfb6b58d180b1acad9ecb2c35783adbf
MD5 f6530ea087764dc5a82b5801b8b1b305
SHA1 4a1bf329eddce0d3a524523f143093a181c8e4c2
SHA512 b54c04f3b20dd8db68953df3aaa6223dd7c484f6c6c8215206fc955f1ef8b51d483c8c0f9bf974fcc8a5397ec4d39ee5f9ab4b5ab0986a8b75343d6c1628f289
SSDEEP 6144:ZNZOc6pk/SFCNh/H2Bf8EhjhLzaU5Rz3Zspl:Mk6FCxElhLzaUJs
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

admin8888 darkgate

Malware Config

Extracted

Family

darkgate

Botnet

admin8888

buassinnndm.net

Attributes

anti_analysis
true
anti_debug
false
anti_vm
true
c2_port
80
check_disk
false
check_ram
false
check_xeon
false
crypter_au3
false
crypter_dll
false
crypter_raw_stub
false
internal_mutex
losBHUAX
minimum_disk
100
minimum_ram
4096
ping_interval
6
rootkit
false
startup_persistence
true
username
admin8888

Signatures

Darkgate family
darkgate

Detect DarkGate stealer 1 IoCs

resource	yara_rule
static1/unpack001/3c64cbb7e7212d920322dae62665b05ceb63a0ad6074cac3ba518cedc5c6dd48.exe	family_darkgate_v6

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/3c64cbb7e7212d920322dae62665b05ceb63a0ad6074cac3ba518cedc5c6dd48.exe

File Explorer

3c64cbb7e7212d920322dae62665b05ceb63a0ad6074cac3ba518cedc5c6dd48.zip

.zip 218KB
3c64cbb7e7212d920322dae62665b05ceb63a0ad6074cac3ba518cedc5c6dd48.exe

.exe 454KB

3c64cbb7e7212d920322dae62665b05ceb63a0ad6074cac3ba518cedc5c6dd48.zip

SHA256 1139c2997698f93629c269abadd593ecdfb6b58d180b1acad9ecb2c35783adbf
MD5 f6530ea087764dc5a82b5801b8b1b305
SHA1 4a1bf329eddce0d3a524523f143093a181c8e4c2
SHA512 b54c04f3b20dd8db68953df3aaa6223dd7c484f6c6c8215206fc955f1ef8b51d483c8c0f9bf974fcc8a5397ec4d39ee5f9ab4b5ab0986a8b75343d6c1628f289
SSDEEP 6144:ZNZOc6pk/SFCNh/H2Bf8EhjhLzaU5Rz3Zspl:Mk6FCxElhLzaUJs
MD5 SHA1 SHA512 SSDEEP

Password

infected

3c64cbb7e7212d920322dae62665b05ceb63a0ad6074cac3ba518cedc5c6dd48.exe

SHA256 3c64cbb7e7212d920322dae62665b05ceb63a0ad6074cac3ba518cedc5c6dd48
MD5 2143d7603258b2801f7ed154b5da3da6
SHA1 5e9c26503ebac94a83b78a03057237ccce365a50
SHA512 061bdda42dd16812ae1ced3b4c9a9e99b600c7593f74397e4296e4b86386353fb8a0adfa8831d1c8f3fd98a7aa3550125f84ab88307808cdd50215ac210b9ebd
SSDEEP 12288:FtkKpKF2q1F3WbaPio/TKvJzghvOXK7BOYV:FtZA1F3WbaPio/OvJ09VUe
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Detect DarkGate stealer
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

375396

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

368KB

Virtual Size

368KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

3c64cbb7e7212d920322dae62665b05ceb63a0ad6074cac3ba518cedc5c6dd48.zip

3c64cbb7e7212d920322dae62665b05ceb63a0ad6074cac3ba518cedc5c6dd48.exe

generic