Extracted

• • Target

    2024-12-11_89431de4fd8ed4f4cc9ed7e55057580f_luca-stealer_magniber

  • Size

    4.5MB

  • MD5

    89431de4fd8ed4f4cc9ed7e55057580f

  • SHA1

    a00e9a3a4f7ded604b8b739db6c8de22ae5a9c58

  • SHA256

    476cc1cc38157e647526ed2c8b295abe68e316c05ad33796b4df0a0b20f9a11d

  • SHA512

    cebca184d9ce7f2e9e5dd10c6d0137ecc763d6a69d6d21b297286de020e93099b3d7be6c215cd2b3289c11aa4de0cd3cea860c4a37c3f9c0bde1bd90f5dc41e4

  • SSDEEP

    98304:bFO4oV0MYjRj6N/MftXyfSoQdATd/2kUs8SN43:bFOjVLYjR2NiXwSoOAB/2Rs8SN4

  Score

  10^/10

  darkgatedrk3discoveryexecutionpersistencestealer

  • DarkGate

    DarkGate is an infostealer written in C++.

    stealerdarkgate

  • Darkgate family

    darkgate

  • Detect DarkGate stealer

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: AutoIT

    Using AutoIT for possible automate script.

    execution
  behavioral1behavioral2