Overview

overview

10

Static

static

3

ea9b553105...1c.exe

windows7-x64

10

ea9b553105...1c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5ebc417a27fd967aea3e1946218ab4777b5440154fd62f5107958ca18cbdd7c1

  • Size

    2.7MB

  • Sample

    240520-xw75rsdc89

  • MD5

    d13130eea36da039414567ca09e730df

  • SHA1

    18ff4cdcf33a835b5e4977431cc0e0e5dfb8b68f

  • SHA256

    5ebc417a27fd967aea3e1946218ab4777b5440154fd62f5107958ca18cbdd7c1

  • SHA512

    4661d638cbbf3ccebfeea04f8fe376761679801d6bded5fe400c10e045f723fac0b7c96fcc0948c650857c05b2796c992b41b3236910ccf1c64a7b72c367ed7b

  • SSDEEP

    49152:zIY/rUaiIDigEnVGFYAguQ+EHvwSCMnrYoLw6deJITmm+Tezg4/25qdjT:z/nDiBIaAgGEPwSBDwCek+TKZ3

Score
10/10
darkgateadmin888stealer

Malware Config

Extracted

Family

darkgate

Botnet

admin888

C2

wear626.com

Attributes
  • anti_analysis

    true

  • anti_debug

    false

  • anti_vm

    true

  • c2_port

    80

  • check_disk

    false

  • check_ram

    false

  • check_xeon

    false

  • crypter_au3

    false

  • crypter_dll

    false

  • crypter_raw_stub

    false

  • internal_mutex

    TNduHZgm

  • minimum_disk

    100

  • minimum_ram

    4096

  • ping_interval

    6

  • rootkit

    false

  • startup_persistence

    false

  • username

    admin888

Targets

    • Target

      ea9b553105dd8302e968588983b3cb34babd71c445df032b3df0d0a329a1801c

    • Size

      5.8MB

    • MD5

      9141124b2e5134ebf702b7ef23d23637

    • SHA1

      4c404f9d2c165c8af4734d2179626503195c15f7

    • SHA256

      ea9b553105dd8302e968588983b3cb34babd71c445df032b3df0d0a329a1801c

    • SHA512

      cfe9e92dd4a7713143115386b4af4e5191c8f1caf4e616f7a68b4dc4018bff7ac0e42394b80fed8571ec834c10f4ba308a6a77d6b700a0920e31b9a87a0497d1

    • SSDEEP

      49152:1MjL2Ell1rb/TQvO90d7HjmAFd4A64nsfJDrM/otoaYUcDX7OBtMy7AT5eovoYid:I1MbHXKF7AT59s8ibQE+gz

    Score
    10/10
    darkgateadmin888stealer

    • DarkGate

      DarkGate is an infostealer written in C++.

      stealerdarkgate

    • Detect DarkGate stealer

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks