2968-14-0x0000000004B60000-0x0000000004EAF000-memory.dmp
- SHA256 b29d02c66866333fe5ee395c686a6d24cdfbc8e5f49f417894f1486755253ab0
-
Detect DarkGate stealer
General
- Target 2968-14-0x0000000004B60000-0x0000000004EAF000-memory.dmp
- Size 3.3MB
- Sample240527-s5ateaac63
- SHA256 b29d02c66866333fe5ee395c686a6d24cdfbc8e5f49f417894f1486755253ab0
- MD5 a44c38cd609c76b10017ef95861596b6
- SHA1 93beb645b3a93c4f0626e651e823b1e9353a1bd9
- SHA512 aa797fea5e03859f955fdd3d293afa00eb0545b6ffefbc0ca4819bbdd86cb457714bcb580a3c8db08d1023b288205374a2714151e8bc224ec92e4f40149f70a1
- SSDEEP 6144:Ra4susLSmmTDKGj/h7aM1mg7EbUze8KnZ9uoarxOeyMTo4GOnyXk4C:4zusLq2u/h7aml7EbUwUceZ1GOnWRC
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
darkgate
Botnet
-
admin888
C2
-
afdhf198jfadafdkfad.com
Attributes
-
anti_analysis
true
-
anti_debug
false
-
anti_vm
true
-
c2_port
80
-
check_disk
false
-
check_ram
false
-
check_xeon
false
-
crypter_au3
false
-
crypter_dll
false
-
crypter_raw_stub
false
-
internal_mutex
lrDcZuOq
-
minimum_disk
50
-
minimum_ram
7000
-
ping_interval
6
-
rootkit
false
-
startup_persistence
true
-
username
admin888
Signatures
- Darkgate family
- Detect DarkGate stealer 1 IoCs
resource yara_rule sample family_darkgate_v6
File Explorer
-
2968-14-0x0000000004B60000-0x0000000004EAF000-memory.dmp3.3MB