darkgate

General

Target

933fbda1ca7c4a52adbb48d038c8ba5ed5ee411d1096b2222ca383ca6d96a6bc.zip
Size

2.0MB
Sample

240822-h98wwsvdrh
MD5

ab3c640841540414d0583e744693da75
SHA1

8156b216fd7059dbd1046b943ade1b0a6a64de1b
SHA256

933fbda1ca7c4a52adbb48d038c8ba5ed5ee411d1096b2222ca383ca6d96a6bc
SHA512

7b52ac1858e1ddf3a8908169b935c428ad3a37ee12f0b61130d9eb1c08841b84b8c3820804a31f00de152030b4242b5020ca17ddcdd48c47b14a4d05f525e8f8
SSDEEP

49152:yTZOriGAFEogB1WLgelipZlroMB6n1FI1VVkeXeKZZD:eOri6JULdiFExXuDXl9

Score

10^/10

Malware Config

Extracted

Family

darkgate

Version

C2

http://sanibroadbandcommunicton.duckdns.org

Attributes

anti_analysis
false
anti_debug
false
anti_vm
false
c2_port
5864
check_disk
false
check_ram
false
check_xeon
false
crypter_au3
false
crypter_dll
false
crypter_raw_stub
true
crypto_key
LAbQdWWsbybjAY
internal_mutex
bbcAde
minimum_disk
100
minimum_ram
4096
ping_interval
10
rootkit
false
startup_persistence
false

Extracted

Family

darkgate

Version

uPtZ

C2

http://sanibroadbandcommunicton.duckdns.org

Attributes

anti_analysis
false
anti_debug
false
anti_vm
false
c2_port
5864
check_disk
false
check_ram
false
check_xeon
false
crypter_au3
false
crypter_dll
true
crypter_raw_stub
false
crypto_key
qwNPPzrRTNHogf
internal_mutex
hykYbY
minimum_disk
100
minimum_ram
4096
ping_interval
1
rootkit
false
startup_persistence
true

Targets

- Target
  
  libssp-0.dll
- Size
  
  88KB
- MD5
  
  1f521e8b258d2b09f66fb8c940452b72
- SHA1
  
  7d669fe4108d40ed431a6728a27a2efc5c153bd0
- SHA256
  
  7786e9e3c7fe54f52b54e4bb922ef569ad68dc14f4096d530824556975e0f462
- SHA512
  
  61058ec95c20ff46f3613f3bd7647231943b64f8171eb0327ee72613a079bd9d8e639434208bb120b1d5242075a13be6686c0dfd31c04932a93f1bef413192d3
- SSDEEP
  
  1536:+wzc7A4bn7UPoru9A6KKsmD2LNEVYxi485/xchTF/fBcA7Oola9:Jc0on7UPoru93VrD2ZqYxi485ZcvniAm
Score

3^/10

discovery
behavioral1
- Target
  
  pidgin.exe
- Size
  
  108KB
- MD5
  
  c283b2379ea584aab52abee0844b02a0
- SHA1
  
  903f9c7dcadf578637d604be681588fffec90e9b
- SHA256
  
  8292226e43a1aced9d38e2bdfb14cebabc12f9aa0a76ebdc47971eac026407f2
- SHA512
  
  a7e285d0d7ed7f212d33da6957ed9b2ba70ecd0e69852b52f33ebedc4682a1dc9621f6304b4c06b91b9ea74d94f1b6c3fad1d1f6f67f18512245870f908cd157
- SSDEEP
  
  1536:dV7q+SakHLKZ9tCAxtXSB5TDW/3CEdbjYVl4NGGwWArUiqvBwy/kTkiw3ciwjm:dpHKeJCCtX8TDafkVl4sG10MLoPm
Score

10^/10

darkgate discovery stealer
- DarkGate
  DarkGate is an infostealer written in C++.
  stealer darkgate
- Detect DarkGate stealer
- Blocklisted process makes network request
- Drops startup file
- Suspicious use of SetThreadContext
behavioral2
- Target
  
  sqlite3.dll
- Size
  
  488KB
- MD5
  
  05ec7e9dee5c43b659d7843f6eb462a2
- SHA1
  
  1d37a930765e282b75b1d129258e21f683379245
- SHA256
  
  b98bacd2a12a4912acb8e6c8b4447c19b811672f5d6c43048b62c9e273c863d4
- SHA512
  
  fbdd1f7ec8dff695f8914dcd088a1217389d5d6c2c7b130ab8d87679f9f1cf8aa0c62ee303de07b0aa920b4e62a34132c788b20f53e5829d2d9a845ef32ad4f6
- SSDEEP
  
  6144:c8P1KXL4EtTnVQoo/tkq4+8RnTl4SOyeaC9TOS1K/xHmnr4AK1i749H22HlLxDED:RKttTckqDUnayvUK5sT09Hn1xDEEcb
Score

1^/10
behavioral3