Extracted

Extracted

Extracted

Extracted

• • Target

    apk/cyberRat/Port 7262 sample build/Google News.apk

  • Size

    292KB

  • MD5

    9dc59c231c11656c36181890e3699bec

  • SHA1

    9c4cde8c2413fe82edf3f820a68baba75a60deaa

  • SHA256

    e954167775d56cd819a15df364b572e83dd0096100ac1ceb27227d3cbbd7d8cc

  • SHA512

    580c1a0b921df0df11f8f847427d501a3986b4c3952283c3a2bd01ef5741c4eb5940eef2c62153498eefe3b3bbb8f316f4489aea594cec6b68c64f1cb91a661f

  • SSDEEP

    6144:DTCiuxS+i3eb4j+wNvmCGfZFxADyd6RwV5U1Sgi6WrjykWK2BGi3xapWQ:PnusT3cgtN0FeS6Rq21SgH8tWDBaQQ

  Score

  1^/10
  behavioral1behavioral2

• • Target

    apk/cyberRat/Port 7262 sample build/index.html

  • Size

    331B

  • MD5

    a1b267742dd8aa08e549c632bd4f26fd

  • SHA1

    4d3b8c2b16554bb002dd825cf40d24429e82c08b

  • SHA256

    76ddc2872947ba922fb13e95c4122710431c0476f09479a282ca6a3a0e60bf4e

  • SHA512

    df1af12e0511edb7b9567fb0230fe5fd19acb3c0571e153285f340c5a3b897d9c981c2fc2460422c55e5a430177a6deb8f54db115258f2f2c2a19076bf7efa3d

  Score

  3^/10

  discovery
  behavioral3behavioral4

• • Target

    apk/cyberRat/index.html

  • Size

    320B

  • MD5

    444da12821a326256a5e24ba00a172a6

  • SHA1

    ff78e28f267610433a0047e0fc1987528ab3916c

  • SHA256

    500eb7dcad515a6b442d77fd100bf67365bf1ba318c88c006d75bdcc75aac707

  • SHA512

    648f5103894e9e4341ba28ce3f43430d14e0c2cb3e663a006bd29bca20bc940a776cfbcfc82c182de750051f090f5d578071943a84cd1d7afe206c53d4341490

  Score

  3^/10

  discovery
  behavioral5behavioral6

• • Target

    exe/crypted/Dakrgate 5864 startup plus rootkit/Batch file for 5864v dll crypted darkgate/update.bat

  • Size

    6KB

  • MD5

    97b7c88a02b2a5214d742b7ed50f4544

  • SHA1

    15bf7dd44049b94db1a82504802ead45f6186fa0

  • SHA256

    20c3a5b1c87627e9e016494b806273230f5023cf12d2c0e29eceecb7b8a6d3b6

  • SHA512

    918c856e61d8b348a705227ec381a8101481ec3aaa4a1f6545b9706ebf491d311cfe716f62ab04c796333bae5df857fc67cac86760be1c67578ca1031a906b25

  • SSDEEP

    192:GqNFRmxkyzz06ETWtd4pTunJ8ccJkBhKhgQ:Vp2kgzSTWsu6hJEhKht

  Score

  10^/10

  execution

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Legitimate hosting services abused for malware hosting/C2

  behavioral7behavioral8

• • Target

    exe/crypted/Dakrgate 5864 startup plus rootkit/Crypted_with AU3 with startup only with decoded Launcher VBS/launcher.vbs

  • Size

    354B

  • MD5

    4cb1a7cb21db24824c33bfd995dae81d

  • SHA1

    59739c2f8186e20bfad09eb029df6688c673ea3f

  • SHA256

    0dfbfd429529d8ce274ecd35f1e8faa55e7bcfc16a93968fe6fbb109f7955654

  • SHA512

    eb9d0921594c1cc6857f1ba4aff134b1cc7b7073b815d7d047e9d8949b977051a625a76cb6725f817b91fb384bedb8700c5f1dd556b5b453bdfefae29bcdd528

  Score

  10^/10

  darkgatediscoverystealer

  • DarkGate

    DarkGate is an infostealer written in C++.

    stealerdarkgate

  • Detect DarkGate stealer

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral10behavioral9

• • Target

    exe/crypted/Dakrgate 5864 startup plus rootkit/Crypted_with AU3 with startup only with decoded Launcher VBS/libssp-0.dll

  • Size

    770KB

  • MD5

    9cf28d8d1916c757499f0aea74e3ed5b

  • SHA1

    cfadad24e61f9f07c3521c2ae062beb2ae7f561b

  • SHA256

    fc6b261d33190b4a0d37ab6e4a96623f646cc21a4186587051479a12ad2fcb39

  • SHA512

    a2e9794e28547f9cb1bfe2b8f07fd62664f94827b463edf11bd0b4888fec2c691423d3312f9ecb238da84d6b15c6db11a585ea1b343bf5bc47f07d6b5075a284

  • SSDEEP

    24576:284puZmUc1qMZ/Z3uP2nY9aJJAEnBrpFlp9Scs4npH7tcqK:r4z/g98npHyn

  Score

  1^/10
  behavioral11behavioral12

• • Target

    exe/crypted/Dakrgate 5864 startup plus rootkit/Crypted_with AU3 with startup only with decoded Launcher VBS/sqlite3.dll

  • Size

    872KB

  • MD5

    c56b5f0201a3b3de53e561fe76912bfd

  • SHA1

    2a4062e10a5de813f5688221dbeb3f3ff33eb417

  • SHA256

    237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

  • SHA512

    195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

  • SSDEEP

    12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01

  Score

  3^/10

  discovery
  behavioral13behavioral14

• • Target

    exe/crypted/Dakrgate 5864 startup plus rootkit/protected_AU3_cGig/libssp-0.dll

  • Size

    88KB

  • MD5

    1f521e8b258d2b09f66fb8c940452b72

  • SHA1

    7d669fe4108d40ed431a6728a27a2efc5c153bd0

  • SHA256

    7786e9e3c7fe54f52b54e4bb922ef569ad68dc14f4096d530824556975e0f462

  • SHA512

    61058ec95c20ff46f3613f3bd7647231943b64f8171eb0327ee72613a079bd9d8e639434208bb120b1d5242075a13be6686c0dfd31c04932a93f1bef413192d3

  • SSDEEP

    1536:+wzc7A4bn7UPoru9A6KKsmD2LNEVYxi485/xchTF/fBcA7Oola9:Jc0on7UPoru93VrD2ZqYxi485ZcvniAm

  Score

  3^/10

  discovery
  behavioral15behavioral16

• • Target

    exe/crypted/Dakrgate 5864 startup plus rootkit/protected_AU3_cGig/pidgin.exe

  • Size

    108KB

  • MD5

    c283b2379ea584aab52abee0844b02a0

  • SHA1

    903f9c7dcadf578637d604be681588fffec90e9b

  • SHA256

    8292226e43a1aced9d38e2bdfb14cebabc12f9aa0a76ebdc47971eac026407f2

  • SHA512

    a7e285d0d7ed7f212d33da6957ed9b2ba70ecd0e69852b52f33ebedc4682a1dc9621f6304b4c06b91b9ea74d94f1b6c3fad1d1f6f67f18512245870f908cd157

  • SSDEEP

    1536:dV7q+SakHLKZ9tCAxtXSB5TDW/3CEdbjYVl4NGGwWArUiqvBwy/kTkiw3ciwjm:dpHKeJCCtX8TDafkVl4sG10MLoPm

  Score

  10^/10

  darkgatediscoverystealer

  • DarkGate

    DarkGate is an infostealer written in C++.

    stealerdarkgate

  • Detect DarkGate stealer

  • Blocklisted process makes network request

  • Drops startup file

  • Suspicious use of SetThreadContext

  behavioral17behavioral18

• • Target

    exe/crypted/Dakrgate 5864 startup plus rootkit/protected_AU3_cGig/sqlite3.dll

  • Size

    488KB

  • MD5

    05ec7e9dee5c43b659d7843f6eb462a2

  • SHA1

    1d37a930765e282b75b1d129258e21f683379245

  • SHA256

    b98bacd2a12a4912acb8e6c8b4447c19b811672f5d6c43048b62c9e273c863d4

  • SHA512

    fbdd1f7ec8dff695f8914dcd088a1217389d5d6c2c7b130ab8d87679f9f1cf8aa0c62ee303de07b0aa920b4e62a34132c788b20f53e5829d2d9a845ef32ad4f6

  • SSDEEP

    6144:c8P1KXL4EtTnVQoo/tkq4+8RnTl4SOyeaC9TOS1K/xHmnr4AK1i749H22HlLxDED:RKttTckqDUnayvUK5sT09Hn1xDEEcb

  Score

  1^/10
  behavioral19behavioral20

• • Target

    libssp-0.dll

  • Size

    88KB

  • MD5

    1f521e8b258d2b09f66fb8c940452b72

  • SHA1

    7d669fe4108d40ed431a6728a27a2efc5c153bd0

  • SHA256

    7786e9e3c7fe54f52b54e4bb922ef569ad68dc14f4096d530824556975e0f462

  • SHA512

    61058ec95c20ff46f3613f3bd7647231943b64f8171eb0327ee72613a079bd9d8e639434208bb120b1d5242075a13be6686c0dfd31c04932a93f1bef413192d3

  • SSDEEP

    1536:+wzc7A4bn7UPoru9A6KKsmD2LNEVYxi485/xchTF/fBcA7Oola9:Jc0on7UPoru93VrD2ZqYxi485ZcvniAm

  Score

  3^/10

  discovery
  behavioral21behavioral22

• • Target

    pidgin.exe

  • Size

    108KB

  • MD5

    c283b2379ea584aab52abee0844b02a0

  • SHA1

    903f9c7dcadf578637d604be681588fffec90e9b

  • SHA256

    8292226e43a1aced9d38e2bdfb14cebabc12f9aa0a76ebdc47971eac026407f2

  • SHA512

    a7e285d0d7ed7f212d33da6957ed9b2ba70ecd0e69852b52f33ebedc4682a1dc9621f6304b4c06b91b9ea74d94f1b6c3fad1d1f6f67f18512245870f908cd157

  • SSDEEP

    1536:dV7q+SakHLKZ9tCAxtXSB5TDW/3CEdbjYVl4NGGwWArUiqvBwy/kTkiw3ciwjm:dpHKeJCCtX8TDafkVl4sG10MLoPm

  Score

  10^/10

  darkgatediscoverystealer

  • DarkGate

    DarkGate is an infostealer written in C++.

    stealerdarkgate

  • Detect DarkGate stealer

  • Blocklisted process makes network request

  • Drops startup file

  • Suspicious use of SetThreadContext

  behavioral23behavioral24

• • Target

    sqlite3.dll

  • Size

    488KB

  • MD5

    05ec7e9dee5c43b659d7843f6eb462a2

  • SHA1

    1d37a930765e282b75b1d129258e21f683379245

  • SHA256

    b98bacd2a12a4912acb8e6c8b4447c19b811672f5d6c43048b62c9e273c863d4

  • SHA512

    fbdd1f7ec8dff695f8914dcd088a1217389d5d6c2c7b130ab8d87679f9f1cf8aa0c62ee303de07b0aa920b4e62a34132c788b20f53e5829d2d9a845ef32ad4f6

  • SSDEEP

    6144:c8P1KXL4EtTnVQoo/tkq4+8RnTl4SOyeaC9TOS1K/xHmnr4AK1i749H22HlLxDED:RKttTckqDUnayvUK5sT09Hn1xDEEcb

  Score

  1^/10
  behavioral25behavioral26

• • Target

    exe/non crypted/Darkgate 5864 port sample not startup/index.html

  • Size

    357B

  • MD5

    81a0a9ea5bad0982db117183726f1300

  • SHA1

    56630b086e3bb78c08785f410fe5d7eefaab775a

  • SHA256

    8dc2fe91915162ebe0393d4d50aa0aa757c68d96968f6887f6e6b546e5f3f880

  • SHA512

    a97857fd1d039cae83ff3418623bd49aea020cc9512adb046f3f591ac8e2661f135f2842d014f69a8042b6ee0125e2664b41638d773f93e97ba4cbe7dd94b115

  Score

  3^/10

  discovery
  behavioral27behavioral28

• • Target

    exe/non crypted/Darkgate 5864 port sample not startup/stubbed.exe

  • Size

    434KB

  • MD5

    32779bb4eda0b1834dc50d88f4930c3e

  • SHA1

    7041fb14c8593d2657d4244d6930a35a2745f96e

  • SHA256

    8a93eabf56949eb69dc5c81a39645fec215d967d126751a8bb72e2f90a3c41c7

  • SHA512

    aeb8e88e9b016df87228be72517694f1c382fde0e1f42bb3e91f0fba22ef8abc7298aec89cb8439d1c1bb20ae2429f1d4bee5a99f9fd78f4a8d7840ca856b0c8

  • SSDEEP

    12288:ObfJmY1oCMa3Wyex7ykWynLSKJ13oqnuj/ro:O7bKCM0ax7ykWynLRJ1Y+uTro

  Score

  10^/10

  darkgatediscoverystealer

  • DarkGate

    DarkGate is an infostealer written in C++.

    stealerdarkgate

  • Detect DarkGate stealer

  • Blocklisted process makes network request

  • Suspicious use of SetThreadContext

  behavioral29behavioral30

• • Target

    exe/non crypted/index.html

  • Size

    360B

  • MD5

    6eb00be1c3f69a79915a5099511e7eee

  • SHA1

    5d8e5a97d6273ae32eb12d10c35fc0f1da668c90

  • SHA256

    67b9aee949ea0c9afd1e408a78bda767ac38fe2386626abe844dca4c754425f1

  • SHA512

    7a3d896307440ddebfb04cfd5f8d09ad0b75a936ba6a7db3440f7ba049564e7380f26cad55a747cad111060302d907c1559e99335f948c9fba2d5b4a3c9a8a3f

  Score

  3^/10

  discovery
  behavioral31behavioral32