Overview

overview

10

Static

static

1

MS_EXCEL_D...ER.hta

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    MS_EXCEL_DOCUMENT_HELPER.hta

  • Size

    2KB

  • Sample

    240506-xl26rsed8w

  • MD5

    af9e3d794e3f9caaabb93b84fb6ba798

  • SHA1

    7aaa1e1e08ed260e9bff99576f66319aa7b05367

  • SHA256

    bfad2a15e46ca4c593a5fa3d721942145ad7a76076d5db6aa835dc3813f7728e

  • SHA512

    5bbecab1f7ca66b7f6620943bb9024fb88a0ce3ed95830af5515fb623e330d16ac967d44a8cc7121ddd9808c7b02476a90ce203de0c69f81f5c77b6378f6cb91

Score
10/10
darkgateadmin888executionstealer

Malware Config

Extracted

Family

darkgate

Botnet

admin888

C2

findyourbackups.com

Attributes
  • anti_analysis

    false

  • anti_debug

    false

  • anti_vm

    false

  • c2_port

    80

  • check_disk

    false

  • check_ram

    false

  • check_xeon

    false

  • crypter_au3

    false

  • crypter_dll

    false

  • crypter_raw_stub

    false

  • internal_mutex

    ljuGymXn

  • minimum_disk

    100

  • minimum_ram

    4096

  • ping_interval

    6

  • rootkit

    false

  • startup_persistence

    true

  • username

    admin888

Targets

    • Target

      MS_EXCEL_DOCUMENT_HELPER.hta

    • Size

      2KB

    • MD5

      af9e3d794e3f9caaabb93b84fb6ba798

    • SHA1

      7aaa1e1e08ed260e9bff99576f66319aa7b05367

    • SHA256

      bfad2a15e46ca4c593a5fa3d721942145ad7a76076d5db6aa835dc3813f7728e

    • SHA512

      5bbecab1f7ca66b7f6620943bb9024fb88a0ce3ed95830af5515fb623e330d16ac967d44a8cc7121ddd9808c7b02476a90ce203de0c69f81f5c77b6378f6cb91

    Score
    10/10
    darkgateadmin888executionstealer

    • DarkGate

      DarkGate is an infostealer written in C++.

      stealerdarkgate

    • Detect DarkGate stealer

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Command and Scripting Interpreter: AutoIT

      Using AutoIT for possible automate script.

      execution
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks