Overview

overview

10

Static

static

1

NotionSetup4.3.04.exe

windows7-x64

10

NotionSetup4.3.04.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    NotionSetup4.3.04.exe

  • Size

    4.1MB

  • Sample

    250123-t1vtfsvrew

  • MD5

    849e4475405de2f405ec0c987c796791

  • SHA1

    ad67cda4c294705ecd45b5e1f14d49b32deb7a1a

  • SHA256

    4fe8bbc88d7a8cc0eec24bd74951f1f00b5127e3899ae53de8dabd6ff417e6db

  • SHA512

    e4232435e69dd6aaa2b81a3fcbfadaeb2b98093d35cdff088e41c38a6d4a8e26082262b62be7ec2e16cb50252afcdf0ca17d7ded914c4cace77ad0c730744324

  • SSDEEP

    49152:nR/KpmZubPf2S8W2ILeWl+C1pvjWy5Snd0eigXNJDLrkThL5X4GmxfUP0FKKsvje:R/jtYLP1Yy5E0eD2vPmuPBZugKdH

Score
10/10
darkgateuser1discoveryexecutionstealer

Malware Config

Extracted

Family

darkgate

Botnet

user1

C2

155.138.149.77

Attributes
  • anti_analysis

    true

  • anti_debug

    false

  • anti_vm

    true

  • c2_port

    80

  • check_disk

    false

  • check_ram

    false

  • check_xeon

    false

  • crypter_au3

    false

  • crypter_dll

    false

  • crypter_raw_stub

    false

  • internal_mutex

    sDcGdADE

  • minimum_disk

    100

  • minimum_ram

    4096

  • ping_interval

    6

  • rootkit

    false

  • startup_persistence

    true

  • username

    user1

Targets

    • Target

      NotionSetup4.3.04.exe

    • Size

      4.1MB

    • MD5

      849e4475405de2f405ec0c987c796791

    • SHA1

      ad67cda4c294705ecd45b5e1f14d49b32deb7a1a

    • SHA256

      4fe8bbc88d7a8cc0eec24bd74951f1f00b5127e3899ae53de8dabd6ff417e6db

    • SHA512

      e4232435e69dd6aaa2b81a3fcbfadaeb2b98093d35cdff088e41c38a6d4a8e26082262b62be7ec2e16cb50252afcdf0ca17d7ded914c4cace77ad0c730744324

    • SSDEEP

      49152:nR/KpmZubPf2S8W2ILeWl+C1pvjWy5Snd0eigXNJDLrkThL5X4GmxfUP0FKKsvje:R/jtYLP1Yy5E0eD2vPmuPBZugKdH

    Score
    10/10
    darkgateuser1discoveryexecutionstealer

    • DarkGate

      DarkGate is an infostealer written in C++.

      stealerdarkgate

    • Darkgate family

      darkgate

    • Detect DarkGate stealer

    • Executes dropped EXE

    • Loads dropped DLL

    • Command and Scripting Interpreter: AutoIT

      Using AutoIT for possible automate script.

      execution
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks