Extracted

• • Target

    86114406553868.csv.exe

  • Size

    3.5MB

  • MD5

    0bd370eef60a45fd61634df249b64b91

  • SHA1

    6758f0170b8227ad373ec35e12e6f300f2f27b42

  • SHA256

    6bef7c9809b35c7a2111872544e68aa29b8323f5936b6b1122c5f4138cf6e1e8

  • SHA512

    b06159c59477dba32c69c53194e832ce2335d038761559328cb04f7f5286d4800fd68f9ac1d61f0063cb138e2e191876e13ab5ee0d03ca9bf44b70e086140f52

  • SSDEEP

    49152:XwREDDMeGGezwQbVqL+ecrCkwYw4z0g3QjfkRiGqUydHeMxWrP+beY7UY714:XwREBGGezfI2hwYDzJQ7UqzdMwZgN

  Score

  10^/10

  darkgateseeksouldiscoveryexecutionpersistencestealer

  • DarkGate

    DarkGate is an infostealer written in C++.

    stealerdarkgate

  • Detect DarkGate stealer

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: AutoIT

    Using AutoIT for possible automate script.

    execution
  behavioral1behavioral2