Extracted

• • Target

    filter0912.2.vbs

  • Size

    250B

  • MD5

    0f5e506c6622ef23867764b600e2c4b4

  • SHA1

    e6b079ecc9537672cc3b8390b0509770045b9bbd

  • SHA256

    793b4e318eba9ef99173836a92ef2959a9ff73026647c0714ab7280f0dbe3fac

  • SHA512

    48fca5308d3a37a7ab974c299c689ce8122b355eb44fe8bc033c80481f73fe74c13586b122d8e86fcd4d26d24153e5a034a8e7262801e3716a2010cbbc8f0b85

  Score

  10^/10

  executiondarkgatedrk3discoverypersistencestealer

  • DarkGate

    DarkGate is an infostealer written in C++.

    stealerdarkgate

  • Darkgate family

    darkgate

  • Detect DarkGate stealer

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: AutoIT

    Using AutoIT for possible automate script.

    execution
  behavioral1behavioral2