Extracted

• • Target

    4_10_AC-2335.xlsx

  • Size

    51KB

  • MD5

    7efe9f3902618e160caafb1f6fd73dd6

  • SHA1

    8f1a3560307e848a01122d088d9136e545726ca8

  • SHA256

    378b000edf3bfe114e1b7ba8045371080a256825f25faaea364cf57fa6d898d7

  • SHA512

    5392ebb12b0fa8225eb532db284bd6e38b23737615471f8bd7e7482b787520eaf3e4937039be2d4ea48e3fb93b787cfecdcd1c1a1b91066bed4a995c5eff72bf

  • SSDEEP

    1536:4s1eZDHgM8v42wkYq84lKL7IAnA4xCQH140Xz:V1eZcMetF8T7IAA4xprD

  Score

  10^/10

  darkgateadmin888stealer

  • DarkGate

    DarkGate is an infostealer written in C++.

    stealerdarkgate

  • Detect DarkGate stealer

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral1behavioral2