Resubmissions

25-08-2024 09:52

240825-lwb7jsxgmh 10

22-08-2024 07:27

240822-h98wwsvdrh 10

22-08-2024 07:21

240822-h651tsxhrk 10

21-08-2024 20:21

240821-y44b8aydje 10

General

  • Target

    933fbda1ca7c4a52adbb48d038c8ba5ed5ee411d1096b2222ca383ca6d96a6bc.zip

  • Size

    2.0MB

  • MD5

    ab3c640841540414d0583e744693da75

  • SHA1

    8156b216fd7059dbd1046b943ade1b0a6a64de1b

  • SHA256

    933fbda1ca7c4a52adbb48d038c8ba5ed5ee411d1096b2222ca383ca6d96a6bc

  • SHA512

    7b52ac1858e1ddf3a8908169b935c428ad3a37ee12f0b61130d9eb1c08841b84b8c3820804a31f00de152030b4242b5020ca17ddcdd48c47b14a4d05f525e8f8

  • SSDEEP

    49152:yTZOriGAFEogB1WLgelipZlroMB6n1FI1VVkeXeKZZD:eOri6JULdiFExXuDXl9

Score
10/10

Malware Config

Extracted

Family

darkgate

Version



C2

http://sanibroadbandcommunicton.duckdns.org

Attributes
  • anti_analysis

    false

  • anti_debug

    false

  • anti_vm

    false

  • c2_port

    5864

  • check_disk

    false

  • check_ram

    false

  • check_xeon

    false

  • crypter_au3

    false

  • crypter_dll

    false

  • crypter_raw_stub

    true

  • crypto_key

    LAbQdWWsbybjAY

  • internal_mutex

    bbcAde

  • minimum_disk

    100

  • minimum_ram

    4096

  • ping_interval

    10

  • rootkit

    false

  • startup_persistence

    false

Signatures

  • Darkgate family
  • Detect DarkGate stealer 1 IoCs
  • Unsigned PE 3 IoCs

    Checks for missing Authenticode signature.

Files

  • 933fbda1ca7c4a52adbb48d038c8ba5ed5ee411d1096b2222ca383ca6d96a6bc.zip
    .zip
  • apk/cyberRat/Port 7262 sample build/Google News.apk
    .jar
  • apk/cyberRat/Port 7262 sample build/index.html
    .html
  • apk/cyberRat/index.html
    .html
  • exe/crypted/Dakrgate 5864 startup plus rootkit/Batch file for 5864v dll crypted darkgate/update.bat
  • exe/crypted/Dakrgate 5864 startup plus rootkit/Crypted_with AU3 with startup only with decoded Launcher VBS/launcher.vbs
    .vbs
  • exe/crypted/Dakrgate 5864 startup plus rootkit/Crypted_with AU3 with startup only with decoded Launcher VBS/libssp-0.dll
  • exe/crypted/Dakrgate 5864 startup plus rootkit/Crypted_with AU3 with startup only with decoded Launcher VBS/sqlite3.dll
    .exe windows:5 windows x86 arch:x86

    6ae531f3439aee07e850dbb1ac7115a4


    Code Sign

    Headers

    Imports

    Sections

  • exe/crypted/Dakrgate 5864 startup plus rootkit/protected_AU3_cGig/libssp-0.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • exe/crypted/Dakrgate 5864 startup plus rootkit/protected_AU3_cGig/pidgin.exe
    .exe windows:4 windows x86 arch:x86

    db91b113be7e07e4ea0768c3ae347cd3


    Code Sign

    Headers

    Imports

    Sections

  • exe/crypted/Dakrgate 5864 startup plus rootkit/protected_AU3_cGig/sqlite3.dll
  • exe/crypted/Dakrgate 5864 startup plus rootkit/protected_AU3_cGig/update.zip
    .zip
  • libssp-0.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • pidgin.exe
    .exe windows:4 windows x86 arch:x86

    db91b113be7e07e4ea0768c3ae347cd3


    Code Sign

    Headers

    Imports

    Sections

  • sqlite3.dll
  • exe/non crypted/Darkgate 5864 port sample not startup/index.html
    .html
  • exe/non crypted/Darkgate 5864 port sample not startup/stubbed.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • exe/non crypted/index.html
    .html