933fbda1ca7c4a52adbb48d038c8ba5ed5ee411d1096b2222ca383ca6d96a6bc

Submit
Reports

Overview

overview

Static

static

apk/cyberR...ws.jar

windows7-x64

apk/cyberR...ws.jar

windows10-2004-x64

apk/cyberR...x.html

windows7-x64

apk/cyberR...x.html

windows10-2004-x64

apk/cyberR...x.html

windows7-x64

apk/cyberR...x.html

windows10-2004-x64

exe/crypte...te.bat

windows7-x64

exe/crypte...te.bat

windows10-2004-x64

exe/crypte...er.vbs

windows7-x64

exe/crypte...er.vbs

windows10-2004-x64

exe/crypte...-0.dll

windows7-x64

exe/crypte...-0.dll

windows10-2004-x64

exe/crypte...e3.exe

windows7-x64

exe/crypte...e3.exe

windows10-2004-x64

exe/crypte...-0.dll

windows7-x64

exe/crypte...-0.dll

windows10-2004-x64

exe/crypte...in.exe

windows7-x64

exe/crypte...in.exe

windows10-2004-x64

exe/crypte...e3.dll

windows7-x64

exe/crypte...e3.dll

windows10-2004-x64

libssp-0.dll

windows7-x64

libssp-0.dll

windows10-2004-x64

pidgin.exe

windows7-x64

pidgin.exe

windows10-2004-x64

sqlite3.dll

windows7-x64

sqlite3.dll

windows10-2004-x64

exe/non cr...x.html

windows7-x64

exe/non cr...x.html

windows10-2004-x64

exe/non cr...ed.exe

windows7-x64

exe/non cr...ed.exe

windows10-2004-x64

exe/non cr...x.html

windows7-x64

exe/non cr...x.html

windows10-2004-x64

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19-08-2024 01:51

Sharing

Copy URL

Twitter E-mail

Static task

static1

darkgate

3 signatures

Behavioral task

behavioral1

Sample

apk/cyberRat/Port 7262 sample build/Google News.jar

Resource

win7-20240705-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral2

Sample

apk/cyberRat/Port 7262 sample build/Google News.jar

Resource

win10v2004-20240802-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral3

Sample

apk/cyberRat/Port 7262 sample build/index.html

Resource

win7-20240704-en

discovery

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral4

Sample

apk/cyberRat/Port 7262 sample build/index.html

Resource

win10v2004-20240802-en

discovery

windows10-2004-x64

7 signatures

150 seconds

Behavioral task

behavioral5

Sample

apk/cyberRat/index.html

Resource

win7-20240705-en

discovery

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral6

Sample

apk/cyberRat/index.html

Resource

win10v2004-20240802-en

discovery

windows10-2004-x64

7 signatures

150 seconds

Behavioral task

behavioral7

Sample

exe/crypted/Dakrgate 5864 startup plus rootkit/Batch file for 5864v dll crypted darkgate/update.bat

Resource

win7-20240704-en

execution

windows7-x64

6 signatures

150 seconds

Behavioral task

behavioral8

Sample

exe/crypted/Dakrgate 5864 startup plus rootkit/Batch file for 5864v dll crypted darkgate/update.bat

Resource

win10v2004-20240802-en

execution

windows10-2004-x64

6 signatures

150 seconds

Behavioral task

behavioral9

Sample

exe/crypted/Dakrgate 5864 startup plus rootkit/Crypted_with AU3 with startup only with decoded Launcher VBS/launcher.vbs

Resource

win7-20240704-en

darkgate discovery stealer

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral10

Sample

exe/crypted/Dakrgate 5864 startup plus rootkit/Crypted_with AU3 with startup only with decoded Launcher VBS/launcher.vbs

Resource

win10v2004-20240802-en

darkgate discovery stealer

windows10-2004-x64

13 signatures

150 seconds

Behavioral task

behavioral11

Sample

exe/crypted/Dakrgate 5864 startup plus rootkit/Crypted_with AU3 with startup only with decoded Launcher VBS/libssp-0.dll

Resource

win7-20240708-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral12

Sample

exe/crypted/Dakrgate 5864 startup plus rootkit/Crypted_with AU3 with startup only with decoded Launcher VBS/libssp-0.dll

Resource

win10v2004-20240802-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral13

Sample

exe/crypted/Dakrgate 5864 startup plus rootkit/Crypted_with AU3 with startup only with decoded Launcher VBS/sqlite3.exe

Resource

win7-20240704-en

discovery

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral14

Sample

exe/crypted/Dakrgate 5864 startup plus rootkit/Crypted_with AU3 with startup only with decoded Launcher VBS/sqlite3.exe

Resource

win10v2004-20240802-en

discovery

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral15

Sample

exe/crypted/Dakrgate 5864 startup plus rootkit/protected_AU3_cGig/libssp-0.dll

Resource

win7-20240708-en

discovery

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral16

Sample

exe/crypted/Dakrgate 5864 startup plus rootkit/protected_AU3_cGig/libssp-0.dll

Resource

win10v2004-20240802-en

discovery

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral17

Sample

exe/crypted/Dakrgate 5864 startup plus rootkit/protected_AU3_cGig/pidgin.exe

Resource

win7-20240729-en

darkgate discovery stealer

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral18

Sample

exe/crypted/Dakrgate 5864 startup plus rootkit/protected_AU3_cGig/pidgin.exe

Resource

win10v2004-20240802-en

darkgate discovery stealer

windows10-2004-x64

11 signatures

150 seconds

Behavioral task

behavioral19

Sample

exe/crypted/Dakrgate 5864 startup plus rootkit/protected_AU3_cGig/sqlite3.dll

Resource

win7-20240729-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral20

Sample

exe/crypted/Dakrgate 5864 startup plus rootkit/protected_AU3_cGig/sqlite3.dll

Resource

win10v2004-20240802-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral21

Sample

libssp-0.dll

Resource

win7-20240704-en

discovery

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral22

Sample

libssp-0.dll

Resource

win10v2004-20240802-en

discovery

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral23

Sample

pidgin.exe

Resource

win7-20240704-en

darkgate discovery stealer

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral24

Sample

pidgin.exe

Resource

win10v2004-20240802-en

darkgate discovery stealer

windows10-2004-x64

11 signatures

150 seconds

Behavioral task

behavioral25

Sample

sqlite3.dll

Resource

win7-20240708-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral26

Sample

sqlite3.dll

Resource

win10v2004-20240802-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral27

Sample

exe/non crypted/Darkgate 5864 port sample not startup/index.html

Resource

win7-20240705-en

discovery

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral28

Sample

exe/non crypted/Darkgate 5864 port sample not startup/index.html

Resource

win10v2004-20240802-en

discovery

windows10-2004-x64

7 signatures

150 seconds

Behavioral task

behavioral29

Sample

exe/non crypted/Darkgate 5864 port sample not startup/stubbed.exe

Resource

win7-20240704-en

darkgate discovery stealer

windows7-x64

8 signatures

150 seconds

Behavioral task

behavioral30

Sample

exe/non crypted/Darkgate 5864 port sample not startup/stubbed.exe

Resource

win10v2004-20240802-en

darkgate discovery stealer

windows10-2004-x64

8 signatures

150 seconds

Behavioral task

behavioral31

Sample

exe/non crypted/index.html

Resource

win7-20240708-en

discovery

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral32

Sample

exe/non crypted/index.html

Resource

win10v2004-20240802-en

discovery

windows10-2004-x64

7 signatures

150 seconds

Report Analysis Logs

General

Target

exe/crypted/Dakrgate 5864 startup plus rootkit/Crypted_with AU3 with startup only with decoded Launcher VBS/libssp-0.dll
Size

770KB
MD5

9cf28d8d1916c757499f0aea74e3ed5b
SHA1

cfadad24e61f9f07c3521c2ae062beb2ae7f561b
SHA256

fc6b261d33190b4a0d37ab6e4a96623f646cc21a4186587051479a12ad2fcb39
SHA512

a2e9794e28547f9cb1bfe2b8f07fd62664f94827b463edf11bd0b4888fec2c691423d3312f9ecb238da84d6b15c6db11a585ea1b343bf5bc47f07d6b5075a284
SSDEEP

24576:284puZmUc1qMZ/Z3uP2nY9aJJAEnBrpFlp9Scs4npH7tcqK:r4z/g98npHyn

Score

1^/10

Malware Config

Signatures

Processes

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\exe\crypted\Dakrgate 5864 startup plus rootkit\Crypted_with AU3 with startup only with decoded Launcher VBS\libssp-0.dll",#1
1⤵
PID:2380

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads