Overview

overview

10

Static

static

3

d164269239...ce.exe

windows7-x64

10

d164269239...ce.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d164269239c8825f3f4cb7d0c47f0ace.exe

  • Size

    2.1MB

  • Sample

    240626-nd9q7sscjb

  • MD5

    d164269239c8825f3f4cb7d0c47f0ace

  • SHA1

    f02c8533bea2c7f0f960b7176e7762884350a01a

  • SHA256

    607e8a91c76f444784c2cbc1090cf8724d882d9861641a1f6e0de6b2b9401859

  • SHA512

    18330248658d422d247d8120ec449b1d65a8ec3a0e17d89fadfff561eb82274afe871fcc87a873747e0f32b0e3a2211c7bb580f21bba768b11a04fbc05901874

  • SSDEEP

    49152:Xg8c4R4uG7M/Yh6pUiN48nTEIQMSqjMXIZQ9M81CODDu:Xg4OuG7Me6pUiN40EsFoMQuOD

Score
10/10
darkgate2newn2newn2newexecutionstealer

Malware Config

Extracted

Family

darkgate

Botnet

2newn2newn2new

C2

applylawofattraction.com

Attributes
  • anti_analysis

    true

  • anti_debug

    false

  • anti_vm

    true

  • c2_port

    80

  • check_disk

    false

  • check_ram

    false

  • check_xeon

    false

  • crypter_au3

    false

  • crypter_dll

    false

  • crypter_raw_stub

    false

  • internal_mutex

    vhOtpdAB

  • minimum_disk

    100

  • minimum_ram

    4096

  • ping_interval

    6

  • rootkit

    false

  • startup_persistence

    true

  • username

    2newn2newn2new

Targets

    • Target

      d164269239c8825f3f4cb7d0c47f0ace.exe

    • Size

      2.1MB

    • MD5

      d164269239c8825f3f4cb7d0c47f0ace

    • SHA1

      f02c8533bea2c7f0f960b7176e7762884350a01a

    • SHA256

      607e8a91c76f444784c2cbc1090cf8724d882d9861641a1f6e0de6b2b9401859

    • SHA512

      18330248658d422d247d8120ec449b1d65a8ec3a0e17d89fadfff561eb82274afe871fcc87a873747e0f32b0e3a2211c7bb580f21bba768b11a04fbc05901874

    • SSDEEP

      49152:Xg8c4R4uG7M/Yh6pUiN48nTEIQMSqjMXIZQ9M81CODDu:Xg4OuG7Me6pUiN40EsFoMQuOD

    Score
    10/10
    darkgate2newn2newn2newexecutionstealer

    • DarkGate

      DarkGate is an infostealer written in C++.

      stealerdarkgate

    • Detect DarkGate stealer

    • Executes dropped EXE

    • Loads dropped DLL

    • Command and Scripting Interpreter: AutoIT

      Using AutoIT for possible automate script.

      execution
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks