General
-
Target
darkgate_xor_payload.exe
-
Size
461KB
-
Sample
240502-tfmmcacd21
-
MD5
2a324cba9f874bfd6a567848d9bb6127
-
SHA1
8117ec04dd2e5f773dcdb3253835365b6ec3df9b
-
SHA256
eb64f5c3dc9df31f9a18f736763235703e6c09564f8176889191bb55d2c28198
-
SHA512
90812cc05411bd592df0b5746b178827a7a7139ab6559a3971fadf6ca30af9fab83c63c5d274ddd941d8b616b6c12942e8f996b31132f8c4488b224467dce7a4
-
SSDEEP
12288:VqilipcPNrKEj2R1zNAYFWtInQnqnVrb:VhljPNrKEjezNAYFQGC2
Behavioral task
behavioral1
Sample
darkgate_xor_payload.exe
Resource
win7-20240419-en
Malware Config
Extracted
darkgate
admin888
dogmupdate.com
-
anti_analysis
true
-
anti_debug
false
-
anti_vm
true
-
c2_port
80
-
check_disk
false
-
check_ram
false
-
check_xeon
false
-
crypter_au3
false
-
crypter_dll
false
-
crypter_raw_stub
false
-
internal_mutex
SFZFQODn
-
minimum_disk
100
-
minimum_ram
4096
-
ping_interval
6
-
rootkit
false
-
startup_persistence
true
-
username
admin888
Targets
-
-
Target
darkgate_xor_payload.exe
-
Size
461KB
-
MD5
2a324cba9f874bfd6a567848d9bb6127
-
SHA1
8117ec04dd2e5f773dcdb3253835365b6ec3df9b
-
SHA256
eb64f5c3dc9df31f9a18f736763235703e6c09564f8176889191bb55d2c28198
-
SHA512
90812cc05411bd592df0b5746b178827a7a7139ab6559a3971fadf6ca30af9fab83c63c5d274ddd941d8b616b6c12942e8f996b31132f8c4488b224467dce7a4
-
SSDEEP
12288:VqilipcPNrKEj2R1zNAYFWtInQnqnVrb:VhljPNrKEjezNAYFQGC2
-
Detect DarkGate stealer
-