darkgate | 0cd41809a1231acb1d5e41ac2bddbed3fbedfba12b716206a7718b834bb17233 | Triage

Submit
Reports

Overview

overview

Static

static

1

exec.bat

windows7-x64

exec.bat

windows10-2004-x64

exec.bat

windows10-ltsc 2021-x64

exec.bat

windows11-21h2-x64

Sharing

General

Target

yutighh.zip
Size

783KB
Sample

241214-zkqgpavrgj
MD5

5299cf20895b7f36e4e7943aaf6bee31
SHA1

95395ff87d3d2fe64e32fbc870a15d7c5445394e
SHA256

0cd41809a1231acb1d5e41ac2bddbed3fbedfba12b716206a7718b834bb17233
SHA512

f3beb4233a5b360d699274f1ce08bcccbf5894789572e024d992514e8933cc27013bde1345d10d73c70d8df1c147cd74e00bfd5cef6decf35d49e3c9ead14b13
SSDEEP

12288:+V2jOoeMNnYVzh4BQqJfII8u/EOTKmcI3EUsg2SmMKW9btSKhWIdmxGxl2R54xRQ:+VtCIC5fCeEOqI3EfJSrKw5pW+yGSIRQ

Score

10^/10

darkgate rjacline01395 discovery execution persistence stealer

Static task

static1

Behavioral task

behavioral1

Sample

exec.bat

Resource

win7-20240729-en

darkgate rjacline01395 discovery execution persistence stealer

windows7-x64

14 signatures

30 seconds

Behavioral task

behavioral2

Sample

exec.bat

Resource

win10v2004-20241007-en

darkgate rjacline01395 discovery execution persistence stealer

windows10-2004-x64

13 signatures

30 seconds

Behavioral task

behavioral3

Sample

exec.bat

Resource

win10ltsc2021-20241211-en

darkgate rjacline01395 discovery execution persistence stealer

windows10-ltsc 2021-x64

13 signatures

30 seconds

Behavioral task

behavioral4

Sample

exec.bat

Resource

win11-20241007-en

darkgate rjacline01395 discovery execution persistence stealer

windows11-21h2-x64

13 signatures

30 seconds

Malware Config

Extracted

Family

darkgate

Botnet

rjacline01395

C2

154.216.16.83

Attributes

anti_analysis
false
anti_debug
false
anti_vm
false
c2_port
80
check_disk
false
check_ram
false
check_xeon
false
crypter_au3
false
crypter_dll
false
crypter_raw_stub
false
internal_mutex
VyUZUiNl
minimum_disk
100
minimum_ram
4096
ping_interval
6
rootkit
false
startup_persistence
true
username
rjacline01395

Targets

- Target
  
  exec.bat
- Size
  
  53B
- MD5
  
  a24cdae72701eb47de5b5fa23f1a334b
- SHA1
  
  81ade1778e4d23368acd572fd341b20c4213195d
- SHA256
  
  427ec87377d45ea1177db38051472043b0674ab8f0c181d2386fcf26a0f54636
- SHA512
  
  dfe87e8989acd2213603b61198b6ccc5de7252c0ee000f1fd037f8c9b0ee98072e84293573be7fba5b1e9219c62ff0f407a3ad2886790dda68eaad0fdb8595e2
Score

10^/10

darkgate rjacline01395 discovery execution persistence stealer
- DarkGate
  DarkGate is an infostealer written in C++.
  stealer darkgate
- Darkgate family
  darkgate
- Detect DarkGate stealer
- Adds Run key to start application
  persistence
- Command and Scripting Interpreter: AutoIT
  Using AutoIT for possible automate script.
  execution
behavioral1 behavioral2 behavioral3 behavioral4

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

AutoHotKey & AutoIT

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

Remote System Discovery

System Information Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

darkgaterjacline01395discoveryexecutionpersistencestealer

behavioral2

darkgaterjacline01395discoveryexecutionpersistencestealer

behavioral3

darkgaterjacline01395discoveryexecutionpersistencestealer

behavioral4

darkgaterjacline01395discoveryexecutionpersistencestealer

© 2018-2025

Terms | Privacy