Overview

overview

10

Static

static

1

statapril2...sx.zip

windows10-2004-x64

1

statapril2...3.xlsx

windows10-2004-x64

10

Resubmissions

09-04-2024 15:32

240409-sysewaah45 10

09-04-2024 15:29

240409-swytwaag64 1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    statapril2024-9733.xlsx.zip

  • Size

    50KB

  • Sample

    240409-sysewaah45

  • MD5

    c6bedeff89bf3f406a07e86b571eeecb

  • SHA1

    4f0833a18948204463701a99859474f891b3f791

  • SHA256

    a60239b753c1a5ae7e2820f11a4084752fc409338746c4166b3cedc28b4e8dce

  • SHA512

    8ae55ca05043e8c2d78af21e243b3d6c8a31d38feb35796bc82f07981976e4e32f6a51e794fa7db86e235ad626cb6dc5ee138248dd66a390929a19a69d0ffe59

  • SSDEEP

    768:aYCGAzIukGGedsoaDPHdRjb0bO0DMWn6A39iP32t4iuzEbo6JQHI9:vrv8cPH/vyD6AEPyuzEbo6wI9

Score
10/10
darkgateadmin888stealer

Malware Config

Extracted

Family

darkgate

Botnet

admin888

C2

103.124.106.237

Attributes
  • anti_analysis

    true

  • anti_debug

    false

  • anti_vm

    true

  • c2_port

    80

  • check_disk

    false

  • check_ram

    false

  • check_xeon

    false

  • crypter_au3

    false

  • crypter_dll

    false

  • crypter_raw_stub

    false

  • internal_mutex

    bedxvHpr

  • minimum_disk

    50

  • minimum_ram

    4000

  • ping_interval

    6

  • rootkit

    false

  • startup_persistence

    true

  • username

    admin888

Targets

    • Target

      statapril2024-9733.xlsx.zip

    • Size

      50KB

    • MD5

      c6bedeff89bf3f406a07e86b571eeecb

    • SHA1

      4f0833a18948204463701a99859474f891b3f791

    • SHA256

      a60239b753c1a5ae7e2820f11a4084752fc409338746c4166b3cedc28b4e8dce

    • SHA512

      8ae55ca05043e8c2d78af21e243b3d6c8a31d38feb35796bc82f07981976e4e32f6a51e794fa7db86e235ad626cb6dc5ee138248dd66a390929a19a69d0ffe59

    • SSDEEP

      768:aYCGAzIukGGedsoaDPHdRjb0bO0DMWn6A39iP32t4iuzEbo6JQHI9:vrv8cPH/vyD6AEPyuzEbo6wI9

    Score
    1/10
    behavioral1

    • Target

      statapril2024-9733.xlsx

    • Size

      56KB

    • MD5

      1c9558bf179c79b1c5f5e01970d190c5

    • SHA1

      007c8fac9c1fa4940750b0c95723d63ca7030d78

    • SHA256

      186efcf47d140b869ec75d0d4f3c90ddf4d95c6378cb0195c2be293ccb646899

    • SHA512

      378d95f25a82a1860a27927dc2bca6eeabdb323d88014f158392d732965046518fa19f344bb1d3d392dd1be728b5bf646ec885fdf548b6e9106d58e8c8b20738

    • SSDEEP

      768:ZFnM1dDlT2qpaOKFSGOJdGvoZCPAUJ1YxBardD2TSWGdCIKD15ogXnlq5I3:/mZ2u4OPKIxoEuDKJnlj3

    Score
    10/10
    darkgateadmin888stealer

    • DarkGate

      DarkGate is an infostealer written in C++.

      stealerdarkgate

    • Detect DarkGate stealer

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral2

MITRE ATT&CK Enterprise v15

Tasks