darkgate

Sharing

Copy URL

Twitter E-mail

General

Target

933fbda1ca7c4a52adbb48d038c8ba5ed5ee411d1096b2222ca383ca6d96a6bc.zip
Size

2.0MB
Sample

240819-b9373sxgjd
MD5

ab3c640841540414d0583e744693da75
SHA1

8156b216fd7059dbd1046b943ade1b0a6a64de1b
SHA256

933fbda1ca7c4a52adbb48d038c8ba5ed5ee411d1096b2222ca383ca6d96a6bc
SHA512

7b52ac1858e1ddf3a8908169b935c428ad3a37ee12f0b61130d9eb1c08841b84b8c3820804a31f00de152030b4242b5020ca17ddcdd48c47b14a4d05f525e8f8
SSDEEP

49152:yTZOriGAFEogB1WLgelipZlroMB6n1FI1VVkeXeKZZD:eOri6JULdiFExXuDXl9

Score

10^/10

Malware Config

Extracted

Family

darkgate

Version

http://sanibroadbandcommunicton.duckdns.org

Attributes

anti_analysis
false
anti_debug
false
anti_vm
false
c2_port
5864
check_disk
false
check_ram
false
check_xeon
false
crypter_au3
false
crypter_dll
false
crypter_raw_stub
true
crypto_key
LAbQdWWsbybjAY
internal_mutex
bbcAde
minimum_disk
100
minimum_ram
4096
ping_interval
10
rootkit
false
startup_persistence
false

Extracted

Family

darkgate

Version

Sm29

http://sanibroadbandcommunicton.duckdns.org

Attributes

anti_analysis
false
anti_debug
false
anti_vm
false
c2_port
5864
check_disk
false
check_ram
false
check_xeon
false
crypter_au3
true
crypter_dll
false
crypter_raw_stub
false
crypto_key
VSCWQXzQljxqeo
internal_mutex
hykYbY
minimum_disk
100
minimum_ram
4096
ping_interval
1
rootkit
false
startup_persistence
true

Extracted

Family

darkgate

Version

uPtZ

http://sanibroadbandcommunicton.duckdns.org

Attributes

anti_analysis
false
anti_debug
false
anti_vm
false
c2_port
5864
check_disk
false
check_ram
false
check_xeon
false
crypter_au3
false
crypter_dll
true
crypter_raw_stub
false
crypto_key
qwNPPzrRTNHogf
internal_mutex
hykYbY
minimum_disk
100
minimum_ram
4096
ping_interval
1
rootkit
false
startup_persistence
true

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://tt.vg/download-update-dll1

exe.dropper

https://tt.vg/dlldownload2sqliuit-download

exe.dropper

https://tt.vg/download-latest-update

Targets

- Target
  
  apk/cyberRat/Port 7262 sample build/Google News.apk
- Size
  
  292KB
- MD5
  
  9dc59c231c11656c36181890e3699bec
- SHA1
  
  9c4cde8c2413fe82edf3f820a68baba75a60deaa
- SHA256
  
  e954167775d56cd819a15df364b572e83dd0096100ac1ceb27227d3cbbd7d8cc
- SHA512
  
  580c1a0b921df0df11f8f847427d501a3986b4c3952283c3a2bd01ef5741c4eb5940eef2c62153498eefe3b3bbb8f316f4489aea594cec6b68c64f1cb91a661f
- SSDEEP
  
  6144:DTCiuxS+i3eb4j+wNvmCGfZFxADyd6RwV5U1Sgi6WrjykWK2BGi3xapWQ:PnusT3cgtN0FeS6Rq21SgH8tWDBaQQ
Score

1^/10
behavioral1 behavioral2
- Target
  
  apk/cyberRat/Port 7262 sample build/index.html
- Size
  
  331B
- MD5
  
  a1b267742dd8aa08e549c632bd4f26fd
- SHA1
  
  4d3b8c2b16554bb002dd825cf40d24429e82c08b
- SHA256
  
  76ddc2872947ba922fb13e95c4122710431c0476f09479a282ca6a3a0e60bf4e
- SHA512
  
  df1af12e0511edb7b9567fb0230fe5fd19acb3c0571e153285f340c5a3b897d9c981c2fc2460422c55e5a430177a6deb8f54db115258f2f2c2a19076bf7efa3d
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  
  apk/cyberRat/index.html
- Size
  
  320B
- MD5
  
  444da12821a326256a5e24ba00a172a6
- SHA1
  
  ff78e28f267610433a0047e0fc1987528ab3916c
- SHA256
  
  500eb7dcad515a6b442d77fd100bf67365bf1ba318c88c006d75bdcc75aac707
- SHA512
  
  648f5103894e9e4341ba28ce3f43430d14e0c2cb3e663a006bd29bca20bc940a776cfbcfc82c182de750051f090f5d578071943a84cd1d7afe206c53d4341490
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  
  exe/crypted/Dakrgate 5864 startup plus rootkit/Batch file for 5864v dll crypted darkgate/update.bat
- Size
  
  6KB
- MD5
  
  97b7c88a02b2a5214d742b7ed50f4544
- SHA1
  
  15bf7dd44049b94db1a82504802ead45f6186fa0
- SHA256
  
  20c3a5b1c87627e9e016494b806273230f5023cf12d2c0e29eceecb7b8a6d3b6
- SHA512
  
  918c856e61d8b348a705227ec381a8101481ec3aaa4a1f6545b9706ebf491d311cfe716f62ab04c796333bae5df857fc67cac86760be1c67578ca1031a906b25
- SSDEEP
  
  192:GqNFRmxkyzz06ETWtd4pTunJ8ccJkBhKhgQ:Vp2kgzSTWsu6hJEhKht
Score

10^/10

execution
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Legitimate hosting services abused for malware hosting/C2
behavioral7 behavioral8
- Target
  
  exe/crypted/Dakrgate 5864 startup plus rootkit/Crypted_with AU3 with startup only with decoded Launcher VBS/launcher.vbs
- Size
  
  354B
- MD5
  
  4cb1a7cb21db24824c33bfd995dae81d
- SHA1
  
  59739c2f8186e20bfad09eb029df6688c673ea3f
- SHA256
  
  0dfbfd429529d8ce274ecd35f1e8faa55e7bcfc16a93968fe6fbb109f7955654
- SHA512
  
  eb9d0921594c1cc6857f1ba4aff134b1cc7b7073b815d7d047e9d8949b977051a625a76cb6725f817b91fb384bedb8700c5f1dd556b5b453bdfefae29bcdd528
Score

10^/10

darkgate discovery stealer
- DarkGate
  DarkGate is an infostealer written in C++.
  stealer darkgate
- Detect DarkGate stealer
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
behavioral10 behavioral9
- Target
  
  exe/crypted/Dakrgate 5864 startup plus rootkit/Crypted_with AU3 with startup only with decoded Launcher VBS/libssp-0.dll
- Size
  
  770KB
- MD5
  
  9cf28d8d1916c757499f0aea74e3ed5b
- SHA1
  
  cfadad24e61f9f07c3521c2ae062beb2ae7f561b
- SHA256
  
  fc6b261d33190b4a0d37ab6e4a96623f646cc21a4186587051479a12ad2fcb39
- SHA512
  
  a2e9794e28547f9cb1bfe2b8f07fd62664f94827b463edf11bd0b4888fec2c691423d3312f9ecb238da84d6b15c6db11a585ea1b343bf5bc47f07d6b5075a284
- SSDEEP
  
  24576:284puZmUc1qMZ/Z3uP2nY9aJJAEnBrpFlp9Scs4npH7tcqK:r4z/g98npHyn
Score

1^/10
behavioral11 behavioral12
- Target
  
  exe/crypted/Dakrgate 5864 startup plus rootkit/Crypted_with AU3 with startup only with decoded Launcher VBS/sqlite3.dll
- Size
  
  872KB
- MD5
  
  c56b5f0201a3b3de53e561fe76912bfd
- SHA1
  
  2a4062e10a5de813f5688221dbeb3f3ff33eb417
- SHA256
  
  237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
- SHA512
  
  195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
- SSDEEP
  
  12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  
  exe/crypted/Dakrgate 5864 startup plus rootkit/protected_AU3_cGig/libssp-0.dll
- Size
  
  88KB
- MD5
  
  1f521e8b258d2b09f66fb8c940452b72
- SHA1
  
  7d669fe4108d40ed431a6728a27a2efc5c153bd0
- SHA256
  
  7786e9e3c7fe54f52b54e4bb922ef569ad68dc14f4096d530824556975e0f462
- SHA512
  
  61058ec95c20ff46f3613f3bd7647231943b64f8171eb0327ee72613a079bd9d8e639434208bb120b1d5242075a13be6686c0dfd31c04932a93f1bef413192d3
- SSDEEP
  
  1536:+wzc7A4bn7UPoru9A6KKsmD2LNEVYxi485/xchTF/fBcA7Oola9:Jc0on7UPoru93VrD2ZqYxi485ZcvniAm
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  
  exe/crypted/Dakrgate 5864 startup plus rootkit/protected_AU3_cGig/pidgin.exe
- Size
  
  108KB
- MD5
  
  c283b2379ea584aab52abee0844b02a0
- SHA1
  
  903f9c7dcadf578637d604be681588fffec90e9b
- SHA256
  
  8292226e43a1aced9d38e2bdfb14cebabc12f9aa0a76ebdc47971eac026407f2
- SHA512
  
  a7e285d0d7ed7f212d33da6957ed9b2ba70ecd0e69852b52f33ebedc4682a1dc9621f6304b4c06b91b9ea74d94f1b6c3fad1d1f6f67f18512245870f908cd157
- SSDEEP
  
  1536:dV7q+SakHLKZ9tCAxtXSB5TDW/3CEdbjYVl4NGGwWArUiqvBwy/kTkiw3ciwjm:dpHKeJCCtX8TDafkVl4sG10MLoPm
Score

10^/10

darkgate discovery stealer
- DarkGate
  DarkGate is an infostealer written in C++.
  stealer darkgate
- Detect DarkGate stealer
- Blocklisted process makes network request
- Drops startup file
- Suspicious use of SetThreadContext
behavioral17 behavioral18
- Target
  
  exe/crypted/Dakrgate 5864 startup plus rootkit/protected_AU3_cGig/sqlite3.dll
- Size
  
  488KB
- MD5
  
  05ec7e9dee5c43b659d7843f6eb462a2
- SHA1
  
  1d37a930765e282b75b1d129258e21f683379245
- SHA256
  
  b98bacd2a12a4912acb8e6c8b4447c19b811672f5d6c43048b62c9e273c863d4
- SHA512
  
  fbdd1f7ec8dff695f8914dcd088a1217389d5d6c2c7b130ab8d87679f9f1cf8aa0c62ee303de07b0aa920b4e62a34132c788b20f53e5829d2d9a845ef32ad4f6
- SSDEEP
  
  6144:c8P1KXL4EtTnVQoo/tkq4+8RnTl4SOyeaC9TOS1K/xHmnr4AK1i749H22HlLxDED:RKttTckqDUnayvUK5sT09Hn1xDEEcb
Score

1^/10
behavioral19 behavioral20
- Target
  
  libssp-0.dll
- Size
  
  88KB
- MD5
  
  1f521e8b258d2b09f66fb8c940452b72
- SHA1
  
  7d669fe4108d40ed431a6728a27a2efc5c153bd0
- SHA256
  
  7786e9e3c7fe54f52b54e4bb922ef569ad68dc14f4096d530824556975e0f462
- SHA512
  
  61058ec95c20ff46f3613f3bd7647231943b64f8171eb0327ee72613a079bd9d8e639434208bb120b1d5242075a13be6686c0dfd31c04932a93f1bef413192d3
- SSDEEP
  
  1536:+wzc7A4bn7UPoru9A6KKsmD2LNEVYxi485/xchTF/fBcA7Oola9:Jc0on7UPoru93VrD2ZqYxi485ZcvniAm
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  
  pidgin.exe
- Size
  
  108KB
- MD5
  
  c283b2379ea584aab52abee0844b02a0
- SHA1
  
  903f9c7dcadf578637d604be681588fffec90e9b
- SHA256
  
  8292226e43a1aced9d38e2bdfb14cebabc12f9aa0a76ebdc47971eac026407f2
- SHA512
  
  a7e285d0d7ed7f212d33da6957ed9b2ba70ecd0e69852b52f33ebedc4682a1dc9621f6304b4c06b91b9ea74d94f1b6c3fad1d1f6f67f18512245870f908cd157
- SSDEEP
  
  1536:dV7q+SakHLKZ9tCAxtXSB5TDW/3CEdbjYVl4NGGwWArUiqvBwy/kTkiw3ciwjm:dpHKeJCCtX8TDafkVl4sG10MLoPm
Score

10^/10

darkgate discovery stealer
- DarkGate
  DarkGate is an infostealer written in C++.
  stealer darkgate
- Detect DarkGate stealer
- Blocklisted process makes network request
- Drops startup file
- Suspicious use of SetThreadContext
behavioral23 behavioral24
- Target
  
  sqlite3.dll
- Size
  
  488KB
- MD5
  
  05ec7e9dee5c43b659d7843f6eb462a2
- SHA1
  
  1d37a930765e282b75b1d129258e21f683379245
- SHA256
  
  b98bacd2a12a4912acb8e6c8b4447c19b811672f5d6c43048b62c9e273c863d4
- SHA512
  
  fbdd1f7ec8dff695f8914dcd088a1217389d5d6c2c7b130ab8d87679f9f1cf8aa0c62ee303de07b0aa920b4e62a34132c788b20f53e5829d2d9a845ef32ad4f6
- SSDEEP
  
  6144:c8P1KXL4EtTnVQoo/tkq4+8RnTl4SOyeaC9TOS1K/xHmnr4AK1i749H22HlLxDED:RKttTckqDUnayvUK5sT09Hn1xDEEcb
Score

1^/10
behavioral25 behavioral26
- Target
  
  exe/non crypted/Darkgate 5864 port sample not startup/index.html
- Size
  
  357B
- MD5
  
  81a0a9ea5bad0982db117183726f1300
- SHA1
  
  56630b086e3bb78c08785f410fe5d7eefaab775a
- SHA256
  
  8dc2fe91915162ebe0393d4d50aa0aa757c68d96968f6887f6e6b546e5f3f880
- SHA512
  
  a97857fd1d039cae83ff3418623bd49aea020cc9512adb046f3f591ac8e2661f135f2842d014f69a8042b6ee0125e2664b41638d773f93e97ba4cbe7dd94b115
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  
  exe/non crypted/Darkgate 5864 port sample not startup/stubbed.exe
- Size
  
  434KB
- MD5
  
  32779bb4eda0b1834dc50d88f4930c3e
- SHA1
  
  7041fb14c8593d2657d4244d6930a35a2745f96e
- SHA256
  
  8a93eabf56949eb69dc5c81a39645fec215d967d126751a8bb72e2f90a3c41c7
- SHA512
  
  aeb8e88e9b016df87228be72517694f1c382fde0e1f42bb3e91f0fba22ef8abc7298aec89cb8439d1c1bb20ae2429f1d4bee5a99f9fd78f4a8d7840ca856b0c8
- SSDEEP
  
  12288:ObfJmY1oCMa3Wyex7ykWynLSKJ13oqnuj/ro:O7bKCM0ax7ykWynLRJ1Y+uTro
Score

10^/10

darkgate discovery stealer
- DarkGate
  DarkGate is an infostealer written in C++.
  stealer darkgate
- Detect DarkGate stealer
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
behavioral29 behavioral30
- Target
  
  exe/non crypted/index.html
- Size
  
  360B
- MD5
  
  6eb00be1c3f69a79915a5099511e7eee
- SHA1
  
  5d8e5a97d6273ae32eb12d10c35fc0f1da668c90
- SHA256
  
  67b9aee949ea0c9afd1e408a78bda767ac38fe2386626abe844dca4c754425f1
- SHA512
  
  7a3d896307440ddebfb04cfd5f8d09ad0b75a936ba6a7db3440f7ba049564e7380f26cad55a747cad111060302d907c1559e99335f948c9fba2d5b4a3c9a8a3f
Score

3^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

System Location Discovery

T1614

System Language Discovery

T1614.001

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Targets

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

Legitimate hosting services abused for malware hosting/C2

Detect DarkGate stealer

Blocklisted process makes network request

Checks computer location settings

Drops startup file

Executes dropped EXE

Suspicious use of SetThreadContext

DarkGate

Detect DarkGate stealer

Blocklisted process makes network request

Drops startup file

Suspicious use of SetThreadContext

DarkGate

Detect DarkGate stealer

Blocklisted process makes network request

Drops startup file

Suspicious use of SetThreadContext

DarkGate

Detect DarkGate stealer

Blocklisted process makes network request

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32