darkgate

General

Target

5ba3af74071e58c1f18c22ac35c6cbb7.exe
Size

2.5MB
Sample

240827-lh58gatgme
MD5

5ba3af74071e58c1f18c22ac35c6cbb7
SHA1

7ae9c93f0c69bc86cd7d1abcf34340667a2d791c
SHA256

2e6db642fad3918398b520cf655d6ca7fc040bd177e30a30bd7f549adb4e48c0
SHA512

198fe5be5cbfb1be083a91b8c07ce00204cb925a7b605ad7f72648888ac5f723349694dcd0472cdc7271b40e2948ccee23c80cde31b23de837cff3945cbd4b8e
SSDEEP

49152:XwREDDMAfQRw4z0g3Q1edHeMxWrP+beY7UY714:XwREzfQRDzJQ1edMwZgN

Score

10^/10

Malware Config

Extracted

Family

remcos

Botnet

Mentor

C2

hulolawyo199jestie01.duckdns.org:4871

hulolawyo199jestie01.duckdns.org:4872

hulolawyo199jestie02.duckdns.org:4871

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
false
keylog_crypt
false
keylog_file
nabytrotis.dat
keylog_flag
false
keylog_path
%AppData%
mouse_option
false
mutex
janoutgurf-P6FGU2
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
take_screenshot_option
false
take_screenshot_time
5

Targets

- Target
  
  5ba3af74071e58c1f18c22ac35c6cbb7.exe
- Size
  
  2.5MB
- MD5
  
  5ba3af74071e58c1f18c22ac35c6cbb7
- SHA1
  
  7ae9c93f0c69bc86cd7d1abcf34340667a2d791c
- SHA256
  
  2e6db642fad3918398b520cf655d6ca7fc040bd177e30a30bd7f549adb4e48c0
- SHA512
  
  198fe5be5cbfb1be083a91b8c07ce00204cb925a7b605ad7f72648888ac5f723349694dcd0472cdc7271b40e2948ccee23c80cde31b23de837cff3945cbd4b8e
- SSDEEP
  
  49152:XwREDDMAfQRw4z0g3Q1edHeMxWrP+beY7UY714:XwREzfQRDzJQ1edMwZgN
Score

10^/10

remcos mentor discovery rat darkgate stealer
- DarkGate
  DarkGate is an infostealer written in C++.
  stealer darkgate
- Detect DarkGate stealer
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Executes dropped EXE
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Extracted

Targets

Detect DarkGate stealer

Remcos

Executes dropped EXE

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2