Overview

overview

10

Static

static

10

exe/crypte...te.bat

windows10-1703-x64

10

exe/crypte...er.vbs

windows10-1703-x64

10

exe/crypte...-0.dll

windows10-1703-x64

1

exe/crypte...e3.exe

windows10-1703-x64

3

exe/crypte...-0.dll

windows10-1703-x64

3

exe/crypte...in.exe

windows10-1703-x64

10

exe/crypte...e3.dll

windows10-1703-x64

1

libssp-0.dll

windows10-1703-x64

3

pidgin.exe

windows10-1703-x64

10

sqlite3.dll

windows10-1703-x64

1

exe/non cr...x.html

windows10-1703-x64

4

exe/non cr...ed.exe

windows10-1703-x64

10

exe/non cr...x.html

windows10-1703-x64

4

Resubmissions

25-08-2024 09:52

240825-lwb7jsxgmh 10

22-08-2024 07:27

240822-h98wwsvdrh 10

22-08-2024 07:21

240822-h651tsxhrk 10

21-08-2024 20:21

240821-y44b8aydje 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    933fbda1ca7c4a52adbb48d038c8ba5ed5ee411d1096b2222ca383ca6d96a6bc.zip

  • Size

    2.0MB

  • Sample

    240821-y44b8aydje

  • MD5

    ab3c640841540414d0583e744693da75

  • SHA1

    8156b216fd7059dbd1046b943ade1b0a6a64de1b

  • SHA256

    933fbda1ca7c4a52adbb48d038c8ba5ed5ee411d1096b2222ca383ca6d96a6bc

  • SHA512

    7b52ac1858e1ddf3a8908169b935c428ad3a37ee12f0b61130d9eb1c08841b84b8c3820804a31f00de152030b4242b5020ca17ddcdd48c47b14a4d05f525e8f8

  • SSDEEP

    49152:yTZOriGAFEogB1WLgelipZlroMB6n1FI1VVkeXeKZZD:eOri6JULdiFExXuDXl9

Score
10/10
darkgatediscoveryexecutionstealer

Malware Config

Extracted

Family

darkgate

Version



C2

http://sanibroadbandcommunicton.duckdns.org

Attributes
  • anti_analysis

    false

  • anti_debug

    false

  • anti_vm

    false

  • c2_port

    5864

  • check_disk

    false

  • check_ram

    false

  • check_xeon

    false

  • crypter_au3

    false

  • crypter_dll

    false

  • crypter_raw_stub

    true

  • crypto_key

    LAbQdWWsbybjAY

  • internal_mutex

    bbcAde

  • minimum_disk

    100

  • minimum_ram

    4096

  • ping_interval

    10

  • rootkit

    false

  • startup_persistence

    false

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://tt.vg/download-update-dll1
exe.dropper

https://tt.vg/dlldownload2sqliuit-download
exe.dropper

https://tt.vg/download-latest-update

Extracted

Family

darkgate

Version

Sm29

C2

http://sanibroadbandcommunicton.duckdns.org

Attributes
  • anti_analysis

    false

  • anti_debug

    false

  • anti_vm

    false

  • c2_port

    5864

  • check_disk

    false

  • check_ram

    false

  • check_xeon

    false

  • crypter_au3

    true

  • crypter_dll

    false

  • crypter_raw_stub

    false

  • crypto_key

    VSCWQXzQljxqeo

  • internal_mutex

    hykYbY

  • minimum_disk

    100

  • minimum_ram

    4096

  • ping_interval

    1

  • rootkit

    false

  • startup_persistence

    true

Extracted

Family

darkgate

Version

uPtZ

C2

http://sanibroadbandcommunicton.duckdns.org

Attributes
  • anti_analysis

    false

  • anti_debug

    false

  • anti_vm

    false

  • c2_port

    5864

  • check_disk

    false

  • check_ram

    false

  • check_xeon

    false

  • crypter_au3

    false

  • crypter_dll

    true

  • crypter_raw_stub

    false

  • crypto_key

    qwNPPzrRTNHogf

  • internal_mutex

    hykYbY

  • minimum_disk

    100

  • minimum_ram

    4096

  • ping_interval

    1

  • rootkit

    false

  • startup_persistence

    true

Targets

    • Target

      exe/crypted/Dakrgate 5864 startup plus rootkit/Batch file for 5864v dll crypted darkgate/update.bat

    • Size

      6KB

    • MD5

      97b7c88a02b2a5214d742b7ed50f4544

    • SHA1

      15bf7dd44049b94db1a82504802ead45f6186fa0

    • SHA256

      20c3a5b1c87627e9e016494b806273230f5023cf12d2c0e29eceecb7b8a6d3b6

    • SHA512

      918c856e61d8b348a705227ec381a8101481ec3aaa4a1f6545b9706ebf491d311cfe716f62ab04c796333bae5df857fc67cac86760be1c67578ca1031a906b25

    • SSDEEP

      192:GqNFRmxkyzz06ETWtd4pTunJ8ccJkBhKhgQ:Vp2kgzSTWsu6hJEhKht

    Score
    10/10
    execution

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

    • Target

      exe/crypted/Dakrgate 5864 startup plus rootkit/Crypted_with AU3 with startup only with decoded Launcher VBS/launcher.vbs

    • Size

      354B

    • MD5

      4cb1a7cb21db24824c33bfd995dae81d

    • SHA1

      59739c2f8186e20bfad09eb029df6688c673ea3f

    • SHA256

      0dfbfd429529d8ce274ecd35f1e8faa55e7bcfc16a93968fe6fbb109f7955654

    • SHA512

      eb9d0921594c1cc6857f1ba4aff134b1cc7b7073b815d7d047e9d8949b977051a625a76cb6725f817b91fb384bedb8700c5f1dd556b5b453bdfefae29bcdd528

    Score
    10/10
    darkgatediscoverystealer

    • DarkGate

      DarkGate is an infostealer written in C++.

      stealerdarkgate

    • Detect DarkGate stealer

    • Executes dropped EXE

    • Suspicious use of SetThreadContext

    behavioral2

    • Target

      exe/crypted/Dakrgate 5864 startup plus rootkit/Crypted_with AU3 with startup only with decoded Launcher VBS/libssp-0.dll

    • Size

      770KB

    • MD5

      9cf28d8d1916c757499f0aea74e3ed5b

    • SHA1

      cfadad24e61f9f07c3521c2ae062beb2ae7f561b

    • SHA256

      fc6b261d33190b4a0d37ab6e4a96623f646cc21a4186587051479a12ad2fcb39

    • SHA512

      a2e9794e28547f9cb1bfe2b8f07fd62664f94827b463edf11bd0b4888fec2c691423d3312f9ecb238da84d6b15c6db11a585ea1b343bf5bc47f07d6b5075a284

    • SSDEEP

      24576:284puZmUc1qMZ/Z3uP2nY9aJJAEnBrpFlp9Scs4npH7tcqK:r4z/g98npHyn

    Score
    1/10
    behavioral3

    • Target

      exe/crypted/Dakrgate 5864 startup plus rootkit/Crypted_with AU3 with startup only with decoded Launcher VBS/sqlite3.dll

    • Size

      872KB

    • MD5

      c56b5f0201a3b3de53e561fe76912bfd

    • SHA1

      2a4062e10a5de813f5688221dbeb3f3ff33eb417

    • SHA256

      237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

    • SHA512

      195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

    • SSDEEP

      12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01

    Score
    3/10
    discovery
    behavioral4

    • Target

      exe/crypted/Dakrgate 5864 startup plus rootkit/protected_AU3_cGig/libssp-0.dll

    • Size

      88KB

    • MD5

      1f521e8b258d2b09f66fb8c940452b72

    • SHA1

      7d669fe4108d40ed431a6728a27a2efc5c153bd0

    • SHA256

      7786e9e3c7fe54f52b54e4bb922ef569ad68dc14f4096d530824556975e0f462

    • SHA512

      61058ec95c20ff46f3613f3bd7647231943b64f8171eb0327ee72613a079bd9d8e639434208bb120b1d5242075a13be6686c0dfd31c04932a93f1bef413192d3

    • SSDEEP

      1536:+wzc7A4bn7UPoru9A6KKsmD2LNEVYxi485/xchTF/fBcA7Oola9:Jc0on7UPoru93VrD2ZqYxi485ZcvniAm

    Score
    3/10
    discovery
    behavioral5

    • Target

      exe/crypted/Dakrgate 5864 startup plus rootkit/protected_AU3_cGig/pidgin.exe

    • Size

      108KB

    • MD5

      c283b2379ea584aab52abee0844b02a0

    • SHA1

      903f9c7dcadf578637d604be681588fffec90e9b

    • SHA256

      8292226e43a1aced9d38e2bdfb14cebabc12f9aa0a76ebdc47971eac026407f2

    • SHA512

      a7e285d0d7ed7f212d33da6957ed9b2ba70ecd0e69852b52f33ebedc4682a1dc9621f6304b4c06b91b9ea74d94f1b6c3fad1d1f6f67f18512245870f908cd157

    • SSDEEP

      1536:dV7q+SakHLKZ9tCAxtXSB5TDW/3CEdbjYVl4NGGwWArUiqvBwy/kTkiw3ciwjm:dpHKeJCCtX8TDafkVl4sG10MLoPm

    Score
    10/10
    darkgatediscoverystealer

    • DarkGate

      DarkGate is an infostealer written in C++.

      stealerdarkgate

    • Detect DarkGate stealer

    • Blocklisted process makes network request

    • Drops startup file

    • Suspicious use of SetThreadContext

    behavioral6

    • Target

      exe/crypted/Dakrgate 5864 startup plus rootkit/protected_AU3_cGig/sqlite3.dll

    • Size

      488KB

    • MD5

      05ec7e9dee5c43b659d7843f6eb462a2

    • SHA1

      1d37a930765e282b75b1d129258e21f683379245

    • SHA256

      b98bacd2a12a4912acb8e6c8b4447c19b811672f5d6c43048b62c9e273c863d4

    • SHA512

      fbdd1f7ec8dff695f8914dcd088a1217389d5d6c2c7b130ab8d87679f9f1cf8aa0c62ee303de07b0aa920b4e62a34132c788b20f53e5829d2d9a845ef32ad4f6

    • SSDEEP

      6144:c8P1KXL4EtTnVQoo/tkq4+8RnTl4SOyeaC9TOS1K/xHmnr4AK1i749H22HlLxDED:RKttTckqDUnayvUK5sT09Hn1xDEEcb

    Score
    1/10
    behavioral7

    • Target

      libssp-0.dll

    • Size

      88KB

    • MD5

      1f521e8b258d2b09f66fb8c940452b72

    • SHA1

      7d669fe4108d40ed431a6728a27a2efc5c153bd0

    • SHA256

      7786e9e3c7fe54f52b54e4bb922ef569ad68dc14f4096d530824556975e0f462

    • SHA512

      61058ec95c20ff46f3613f3bd7647231943b64f8171eb0327ee72613a079bd9d8e639434208bb120b1d5242075a13be6686c0dfd31c04932a93f1bef413192d3

    • SSDEEP

      1536:+wzc7A4bn7UPoru9A6KKsmD2LNEVYxi485/xchTF/fBcA7Oola9:Jc0on7UPoru93VrD2ZqYxi485ZcvniAm

    Score
    3/10
    discovery
    behavioral8

    • Target

      pidgin.exe

    • Size

      108KB

    • MD5

      c283b2379ea584aab52abee0844b02a0

    • SHA1

      903f9c7dcadf578637d604be681588fffec90e9b

    • SHA256

      8292226e43a1aced9d38e2bdfb14cebabc12f9aa0a76ebdc47971eac026407f2

    • SHA512

      a7e285d0d7ed7f212d33da6957ed9b2ba70ecd0e69852b52f33ebedc4682a1dc9621f6304b4c06b91b9ea74d94f1b6c3fad1d1f6f67f18512245870f908cd157

    • SSDEEP

      1536:dV7q+SakHLKZ9tCAxtXSB5TDW/3CEdbjYVl4NGGwWArUiqvBwy/kTkiw3ciwjm:dpHKeJCCtX8TDafkVl4sG10MLoPm

    Score
    10/10
    darkgatediscoverystealer

    • DarkGate

      DarkGate is an infostealer written in C++.

      stealerdarkgate

    • Detect DarkGate stealer

    • Blocklisted process makes network request

    • Drops startup file

    • Suspicious use of SetThreadContext

    behavioral9

    • Target

      sqlite3.dll

    • Size

      488KB

    • MD5

      05ec7e9dee5c43b659d7843f6eb462a2

    • SHA1

      1d37a930765e282b75b1d129258e21f683379245

    • SHA256

      b98bacd2a12a4912acb8e6c8b4447c19b811672f5d6c43048b62c9e273c863d4

    • SHA512

      fbdd1f7ec8dff695f8914dcd088a1217389d5d6c2c7b130ab8d87679f9f1cf8aa0c62ee303de07b0aa920b4e62a34132c788b20f53e5829d2d9a845ef32ad4f6

    • SSDEEP

      6144:c8P1KXL4EtTnVQoo/tkq4+8RnTl4SOyeaC9TOS1K/xHmnr4AK1i749H22HlLxDED:RKttTckqDUnayvUK5sT09Hn1xDEEcb

    Score
    1/10
    behavioral10

    • Target

      exe/non crypted/Darkgate 5864 port sample not startup/index.html

    • Size

      357B

    • MD5

      81a0a9ea5bad0982db117183726f1300

    • SHA1

      56630b086e3bb78c08785f410fe5d7eefaab775a

    • SHA256

      8dc2fe91915162ebe0393d4d50aa0aa757c68d96968f6887f6e6b546e5f3f880

    • SHA512

      a97857fd1d039cae83ff3418623bd49aea020cc9512adb046f3f591ac8e2661f135f2842d014f69a8042b6ee0125e2664b41638d773f93e97ba4cbe7dd94b115

    Score
    4/10
    behavioral11

    • Target

      exe/non crypted/Darkgate 5864 port sample not startup/stubbed.exe

    • Size

      434KB

    • MD5

      32779bb4eda0b1834dc50d88f4930c3e

    • SHA1

      7041fb14c8593d2657d4244d6930a35a2745f96e

    • SHA256

      8a93eabf56949eb69dc5c81a39645fec215d967d126751a8bb72e2f90a3c41c7

    • SHA512

      aeb8e88e9b016df87228be72517694f1c382fde0e1f42bb3e91f0fba22ef8abc7298aec89cb8439d1c1bb20ae2429f1d4bee5a99f9fd78f4a8d7840ca856b0c8

    • SSDEEP

      12288:ObfJmY1oCMa3Wyex7ykWynLSKJ13oqnuj/ro:O7bKCM0ax7ykWynLRJ1Y+uTro

    Score
    10/10
    darkgatediscoverystealer

    • DarkGate

      DarkGate is an infostealer written in C++.

      stealerdarkgate

    • Detect DarkGate stealer

    • Blocklisted process makes network request

    • Suspicious use of SetThreadContext

    behavioral12

    • Target

      exe/non crypted/index.html

    • Size

      360B

    • MD5

      6eb00be1c3f69a79915a5099511e7eee

    • SHA1

      5d8e5a97d6273ae32eb12d10c35fc0f1da668c90

    • SHA256

      67b9aee949ea0c9afd1e408a78bda767ac38fe2386626abe844dca4c754425f1

    • SHA512

      7a3d896307440ddebfb04cfd5f8d09ad0b75a936ba6a7db3440f7ba049564e7380f26cad55a747cad111060302d907c1559e99335f948c9fba2d5b4a3c9a8a3f

    Score
    4/10
    behavioral13

MITRE ATT&CK Enterprise v15

Tasks