Overview

overview

10

Static

static

1

Autoit3.exe

windows7-x64

3

Autoit3.exe

windows10-2004-x64

3

exec.bat

windows7-x64

10

exec.bat

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    yutighh.zip

  • Size

    783KB

  • Sample

    241214-zlgaeatnhs

  • MD5

    5299cf20895b7f36e4e7943aaf6bee31

  • SHA1

    95395ff87d3d2fe64e32fbc870a15d7c5445394e

  • SHA256

    0cd41809a1231acb1d5e41ac2bddbed3fbedfba12b716206a7718b834bb17233

  • SHA512

    f3beb4233a5b360d699274f1ce08bcccbf5894789572e024d992514e8933cc27013bde1345d10d73c70d8df1c147cd74e00bfd5cef6decf35d49e3c9ead14b13

  • SSDEEP

    12288:+V2jOoeMNnYVzh4BQqJfII8u/EOTKmcI3EUsg2SmMKW9btSKhWIdmxGxl2R54xRQ:+VtCIC5fCeEOqI3EfJSrKw5pW+yGSIRQ

Score
10/10
darkgaterjacline01395discoveryexecutionpersistencestealer

Malware Config

Extracted

Family

darkgate

Botnet

rjacline01395

C2

154.216.16.83

Attributes
  • anti_analysis

    false

  • anti_debug

    false

  • anti_vm

    false

  • c2_port

    80

  • check_disk

    false

  • check_ram

    false

  • check_xeon

    false

  • crypter_au3

    false

  • crypter_dll

    false

  • crypter_raw_stub

    false

  • internal_mutex

    VyUZUiNl

  • minimum_disk

    100

  • minimum_ram

    4096

  • ping_interval

    6

  • rootkit

    false

  • startup_persistence

    true

  • username

    rjacline01395

Targets

    • Target

      Autoit3.exe

    • Size

      872KB

    • MD5

      c56b5f0201a3b3de53e561fe76912bfd

    • SHA1

      2a4062e10a5de813f5688221dbeb3f3ff33eb417

    • SHA256

      237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

    • SHA512

      195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

    • SSDEEP

      12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01

    Score
    3/10
    discovery
    behavioral1behavioral2

    • Target

      exec.bat

    • Size

      53B

    • MD5

      a24cdae72701eb47de5b5fa23f1a334b

    • SHA1

      81ade1778e4d23368acd572fd341b20c4213195d

    • SHA256

      427ec87377d45ea1177db38051472043b0674ab8f0c181d2386fcf26a0f54636

    • SHA512

      dfe87e8989acd2213603b61198b6ccc5de7252c0ee000f1fd037f8c9b0ee98072e84293573be7fba5b1e9219c62ff0f407a3ad2886790dda68eaad0fdb8595e2

    Score
    10/10
    darkgaterjacline01395discoveryexecutionpersistencestealer

    • DarkGate

      DarkGate is an infostealer written in C++.

      stealerdarkgate

    • Darkgate family

      darkgate

    • Detect DarkGate stealer

    • Adds Run key to start application

      persistence

    • Command and Scripting Interpreter: AutoIT

      Using AutoIT for possible automate script.

      execution
    behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks