darkgate | 3dfde1b581593a96e9bb4370d492897dc681d1ea7028466c3c691b1032da515f

Sharing

Copy URL Twitter E-mail

General

Target
3dfde1b581593a96e9bb4370d492897dc681d1ea7028466c3c691b1032da515f
Size 433KB
Sample240523-zebfksfe82
SHA256 3dfde1b581593a96e9bb4370d492897dc681d1ea7028466c3c691b1032da515f
MD5 4915624a44644b10d71340ac800d08c2
SHA1 4f9269a77670c0012575814349cf6351676b8620
SHA512 b99ff9709e22ee7c980bc752de8aacf4e2c9ab19b4363db3bb9e0a96c40a13695f48a68e38727dbae7b9bf293f89a95eb20791bb91017eae1a40b1bacfcd922b
SSDEEP 12288:3Wy/dWy8VGJcix+d/WS8/Ruv0d5J/zW+hAxqnup/2:3p1p8V0x+d/WS8Hd/W+hAx+uJ2
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkgate

Malware Config

Extracted

Family

darkgate

Version

http://lampixx.hopto.org

Attributes

anti_analysis
false
anti_debug
false
anti_vm
false
c2_port
61689
check_disk
false
check_ram
false
check_xeon
false
crypter_au3
false
crypter_dll
false
crypter_raw_stub
true
crypto_key
raKqdORtLcYsWG
internal_mutex
pIzEhw
minimum_disk
100
minimum_ram
4096
ping_interval
20
rootkit
true
startup_persistence
true

Signatures

Darkgate family
darkgate

Detect DarkGate stealer 1 IoCs

resource	yara_rule
sample	family_darkgate_v6

Detect executables referencing considerable number of Ads blocking browser extension IDs 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_References_AdsBlocker_Browser_Extension_IDs

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3dfde1b581593a96e9bb4370d492897dc681d1ea7028466c3c691b1032da515f

File Explorer

3dfde1b581593a96e9bb4370d492897dc681d1ea7028466c3c691b1032da515f

.exe 433KB

3dfde1b581593a96e9bb4370d492897dc681d1ea7028466c3c691b1032da515f

SHA256 3dfde1b581593a96e9bb4370d492897dc681d1ea7028466c3c691b1032da515f
MD5 4915624a44644b10d71340ac800d08c2
SHA1 4f9269a77670c0012575814349cf6351676b8620
SHA512 b99ff9709e22ee7c980bc752de8aacf4e2c9ab19b4363db3bb9e0a96c40a13695f48a68e38727dbae7b9bf293f89a95eb20791bb91017eae1a40b1bacfcd922b
SSDEEP 12288:3Wy/dWy8VGJcix+d/WS8/Ruv0d5J/zW+hAxqnup/2:3p1p8V0x+d/WS8Hd/W+hAx+uJ2
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Detect DarkGate stealer
Detect executables referencing considerable number of Ads blocking browser extension IDs
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

377324

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

366KB

Virtual Size

366KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

36KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

12B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

23KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

3dfde1b581593a96e9bb4370d492897dc681d1ea7028466c3c691b1032da515f

generic