General

  • Target

    733b6d7a13a3baa568f180755155debf99b272dd526ed374cbf3320c22bc522f.rar

  • Size

    9.2MB

  • Sample

    240515-pr49bahg69

  • MD5

    1d1a0b04767f3cfb44cc39917317b315

  • SHA1

    38eb7805ae13c6388ac537c3c5b800e1e98c465c

  • SHA256

    532f92dc0529f9eeea4c71e9c75476de4ce4ef1a0051e87a79e5cb5c8ac81161

  • SHA512

    1f0479041c30dffd325c1de57714ad49b94e4ac80fc144199437bf60595baf613dfa9555458e92cfa488ce21540fea79849868456078f6bfdd00e30501779f69

  • SSDEEP

    196608:pv07bjyzVvJJxOQWbng665but7kJlLpUsDcKImZJ7Yg3045w1NP:907nYnJxOJzg6wK7w8KbZJ7Y5J1NP

Score
10/10

Malware Config

Extracted

Family

darkgate

Botnet

Dark0

C2

voip.analytics-edges.com

Attributes
  • anti_analysis

    true

  • anti_debug

    false

  • anti_vm

    true

  • c2_port

    443

  • check_disk

    false

  • check_ram

    true

  • check_xeon

    false

  • crypter_au3

    false

  • crypter_dll

    false

  • crypter_raw_stub

    false

  • internal_mutex

    SdtDZtLn

  • minimum_disk

    100

  • minimum_ram

    4096

  • ping_interval

    6

  • rootkit

    false

  • startup_persistence

    true

  • username

    Dark0

Targets

    • Target

      KeyScramblerLogon.exe

    • Size

      500KB

    • MD5

      c790ebfcb6a34953a371e32c9174fe46

    • SHA1

      3ead08d8bbdb3afd851877cb50507b77ae18a4d8

    • SHA256

      fa7ad2f45128120bccc33f996f87a81faa2e9c1236666dd69b943a755f332eb1

    • SHA512

      74e3ab12b2a2d5c45c5248dd2225bfbcf237a01ef94fdca3fe99cfde11bd7d0ccd25dd7f26bd283997d951f4df7e8f4b35f9475a32bdb854d6cc8867b2c45554

    • SSDEEP

      6144:79UJaPbttKBfvX/b9NX7NVdRbjCNK617o41Nptp7Nu+1:7qkbtts3X/b9NX7NVdtC37p7NuK

    Score
    10/10
    • DarkGate

      DarkGate is an infostealer written in C++.

    • Detect DarkGate stealer

MITRE ATT&CK Enterprise v15

Tasks