General
-
Target
2968-14-0x0000000004B60000-0x0000000004EAF000-memory.dmp
-
Size
3.3MB
-
MD5
a44c38cd609c76b10017ef95861596b6
-
SHA1
93beb645b3a93c4f0626e651e823b1e9353a1bd9
-
SHA256
b29d02c66866333fe5ee395c686a6d24cdfbc8e5f49f417894f1486755253ab0
-
SHA512
aa797fea5e03859f955fdd3d293afa00eb0545b6ffefbc0ca4819bbdd86cb457714bcb580a3c8db08d1023b288205374a2714151e8bc224ec92e4f40149f70a1
-
SSDEEP
6144:Ra4susLSmmTDKGj/h7aM1mg7EbUze8KnZ9uoarxOeyMTo4GOnyXk4C:4zusLq2u/h7aml7EbUwUceZ1GOnWRC
Malware Config
Extracted
Family
darkgate
Botnet
admin888
C2
afdhf198jfadafdkfad.com
Attributes
-
anti_analysis
true
-
anti_debug
false
-
anti_vm
true
-
c2_port
80
-
check_disk
false
-
check_ram
false
-
check_xeon
false
-
crypter_au3
false
-
crypter_dll
false
-
crypter_raw_stub
false
-
internal_mutex
lrDcZuOq
-
minimum_disk
50
-
minimum_ram
7000
-
ping_interval
6
-
rootkit
false
-
startup_persistence
true
-
username
admin888
Signatures
-
Darkgate family
-
Detect DarkGate stealer 1 IoCs
resource yara_rule sample family_darkgate_v6
Files
-
2968-14-0x0000000004B60000-0x0000000004EAF000-memory.dmp