Overview

overview

10

Static

static

1

Notion Set...4).exe

windows10-ltsc 2021-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Notion Setup 4.3.0 (3).exe.7z

  • Size

    1.8MB

  • Sample

    250122-zqf57swlfl

  • MD5

    3abf518c7e2d26b73332730840a5c441

  • SHA1

    61a8cf0807e38e1c3548a3624d34877b33910076

  • SHA256

    a279ff2f21dd7f7d250976b60a261dc9a1b7c8ad4c87126cd74a0a84a8a1b121

  • SHA512

    1182e21bcfe3553992e1d5bd7720f12afdb4d97498b9376598f6e446a9b25297cee9c98dda9c193c7c6d700b89bfbd634c426a31907bd063bb827fde6f314025

  • SSDEEP

    49152:GCHrO7FcEfa2JII62nbid7NeNNG4GjnjzoGd:GC0mEjJO2nedw3RGjAq

Score
10/10
darkgateuser1discoveryexecutionstealer

Malware Config

Extracted

Family

darkgate

Botnet

user1

C2

155.138.149.77

Attributes
  • anti_analysis

    true

  • anti_debug

    false

  • anti_vm

    true

  • c2_port

    80

  • check_disk

    false

  • check_ram

    false

  • check_xeon

    false

  • crypter_au3

    false

  • crypter_dll

    false

  • crypter_raw_stub

    false

  • internal_mutex

    sDcGdADE

  • minimum_disk

    100

  • minimum_ram

    4096

  • ping_interval

    6

  • rootkit

    false

  • startup_persistence

    true

  • username

    user1

Targets

    • Target

      Notion Setup 4.3.0 (4).exe

    • Size

      4.1MB

    • MD5

      849e4475405de2f405ec0c987c796791

    • SHA1

      ad67cda4c294705ecd45b5e1f14d49b32deb7a1a

    • SHA256

      4fe8bbc88d7a8cc0eec24bd74951f1f00b5127e3899ae53de8dabd6ff417e6db

    • SHA512

      e4232435e69dd6aaa2b81a3fcbfadaeb2b98093d35cdff088e41c38a6d4a8e26082262b62be7ec2e16cb50252afcdf0ca17d7ded914c4cace77ad0c730744324

    • SSDEEP

      49152:nR/KpmZubPf2S8W2ILeWl+C1pvjWy5Snd0eigXNJDLrkThL5X4GmxfUP0FKKsvje:R/jtYLP1Yy5E0eD2vPmuPBZugKdH

    Score
    10/10
    darkgateuser1discoveryexecutionstealer

    • DarkGate

      DarkGate is an infostealer written in C++.

      stealerdarkgate

    • Darkgate family

      darkgate

    • Detect DarkGate stealer

    • Executes dropped EXE

    • Command and Scripting Interpreter: AutoIT

      Using AutoIT for possible automate script.

      execution
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks