General
-
Target
http://194.26.192.57/
-
Sample
240504-zwpdrsec53
Score
10/10
Malware Config
Extracted
Family
darkgate
Botnet
rjacline6662
C2
91.92.245.171
Attributes
-
anti_analysis
false
-
anti_debug
false
-
anti_vm
false
-
c2_port
8094
-
check_disk
false
-
check_ram
false
-
check_xeon
false
-
crypter_au3
false
-
crypter_dll
false
-
crypter_raw_stub
false
-
internal_mutex
pfHDzZpK
-
minimum_disk
100
-
minimum_ram
4096
-
ping_interval
6
-
rootkit
false
-
startup_persistence
true
-
username
rjacline6662
Targets
-
-
Target
http://194.26.192.57/
Score10/10-
DarkGate
DarkGate is an infostealer written in C++.
-
Detect DarkGate stealer
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops file in System32 directory
-