Overview

overview

10

Static

static

3

lucky.exe

windows10-1703-x64

10

lucky.exe

windows10-2004-x64

10

lucky.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    lucky.exe

  • Size

    4.2MB

  • Sample

    241008-xm1dkaydjh

  • MD5

    1f53e73bb490713b3c1110fae4e7c47d

  • SHA1

    ed81a7d7eb4424d7cb640b712b78295da13705c9

  • SHA256

    1577d3a0157bc9470acd8d6ee6032000648dc7bf007eb5e8d2db4fa7589e896d

  • SHA512

    86216d79c37edea355ec053aaf40cb7fb5be0f21f8d75c0a5298562a9b9945c0e4d43518f5194f39ea8e12b13e25004969b1c0d322c81f45a45f3db39a9f0533

  • SSDEEP

    49152:0pkCgTYgr+hYMME2CuixWh1JKzFfPg6Q2ckEbBYZ6PfjFlmzs1YICRGRCQVhhbBJ:pr+hY3EbOsqjFFv5CQLhtwnSqE

Score
10/10
darkgatex88y8ydiscoveryexecutionstealer

Malware Config

Extracted

Family

darkgate

Botnet

x88y8y

C2

91.222.173.140

Attributes
  • anti_analysis

    true

  • anti_debug

    false

  • anti_vm

    true

  • c2_port

    80

  • check_disk

    false

  • check_ram

    false

  • check_xeon

    false

  • crypter_au3

    false

  • crypter_dll

    false

  • crypter_raw_stub

    false

  • internal_mutex

    HKlXBQij

  • minimum_disk

    100

  • minimum_ram

    4096

  • ping_interval

    6

  • rootkit

    false

  • startup_persistence

    true

  • username

    x88y8y

Targets

    • Target

      lucky.exe

    • Size

      4.2MB

    • MD5

      1f53e73bb490713b3c1110fae4e7c47d

    • SHA1

      ed81a7d7eb4424d7cb640b712b78295da13705c9

    • SHA256

      1577d3a0157bc9470acd8d6ee6032000648dc7bf007eb5e8d2db4fa7589e896d

    • SHA512

      86216d79c37edea355ec053aaf40cb7fb5be0f21f8d75c0a5298562a9b9945c0e4d43518f5194f39ea8e12b13e25004969b1c0d322c81f45a45f3db39a9f0533

    • SSDEEP

      49152:0pkCgTYgr+hYMME2CuixWh1JKzFfPg6Q2ckEbBYZ6PfjFlmzs1YICRGRCQVhhbBJ:pr+hY3EbOsqjFFv5CQLhtwnSqE

    Score
    10/10
    darkgatex88y8ydiscoveryexecutionstealer

    • DarkGate

      DarkGate is an infostealer written in C++.

      stealerdarkgate

    • Detect DarkGate stealer

    • Executes dropped EXE

    • Command and Scripting Interpreter: AutoIT

      Using AutoIT for possible automate script.

      execution
    behavioral1behavioral2behavioral3

MITRE ATT&CK Enterprise v15

Tasks