darkgate

General

Target

files.cab
Size

5.6MB
Sample

250130-z25b6svmhl
MD5

d339565d7c5224c45092b3aaeeb3797f
SHA1

c85565693714583e57fb9addb64368cc87288efa
SHA256

359e387871378831eb1293f41b54436abc6357733d1a573f0caff90ab1cbf07d
SHA512

14b3cb62aa99f53a8205783297285b38268306d4876ebdc65ab42d2c7c5613dc4b7010d3f25f2ad60747e136ff5939dca8f6a986f7161f27c0d791f4e874062b
SSDEEP

49152:gUhtSTK+0THkWsN8SDYdvH5eoQDWeEHHhRgWEF9nuriG7DrFWoRRRJuGgagYmS5G:2nFDcEWoVoFWRGga5q7

Score

10^/10

Malware Config

Extracted

Family

darkgate

Botnet

admin888

C2

prodomainnameeforappru.com

Attributes

anti_analysis
true
anti_debug
false
anti_vm
false
c2_port
443
check_disk
false
check_ram
false
check_xeon
false
crypter_au3
false
crypter_dll
false
crypter_raw_stub
false
internal_mutex
WeBiMyRU
minimum_disk
50
minimum_ram
7000
ping_interval
6
rootkit
false
startup_persistence
true
username
admin888

Targets

- Target
  
  CoreFoundation.dll
- Size
  
  3.6MB
- MD5
  
  b4677a50c291d7c5a7f9f1b80f39a37f
- SHA1
  
  76d183107f9a8f89f09e25149e6e3de777b25d5a
- SHA256
  
  c2d43d768cebcf63e8d0c3ae8ffd2cd5070e4ac656a132b63d5e7372cef69c62
- SHA512
  
  bb2a3bb016cca60bd5f8a33773752e8f88bae764a6497eaaccf563da8607805b5723b30135c001f2fbc20c628e75c099410d9fd09b375c3d2901b6e7f70ba356
- SSDEEP
  
  49152:Psh68THDmkeHoBN8SEsdV+5J+2D8/Etg8:2kbD3
Score

1^/10
behavioral1 behavioral2
- Target
  
  iTunesHelper.exe
- Size
  
  358KB
- MD5
  
  ed6a1c72a75dee15a6fa75873cd64975
- SHA1
  
  67a15ca72e3156f8be6c46391e184087e47f4a0d
- SHA256
  
  0d8878cca08903777888b3681f90e4a07c7aef7d9600a67dfa985844d4bf5eda
- SHA512
  
  256c2ebfeb42c2d3340d8bb423ef0ae48d5fb9fe5ca09c363595f51a03007482b67a777e4cae7a8194f69bc3a3fbcdb9abb5c9f92097925272431bb9d50f5c03
- SSDEEP
  
  6144:TjZtNtzxEFQVLEhZbblN4W6ZDNFfEai23+FM2+zIv+98vS:ZRxMQLEhZXybF8Ut4o8a
Score

10^/10

darkgate admin888 discovery execution stealer
- DarkGate
  DarkGate is an infostealer written in C++.
  stealer darkgate
- Darkgate family
  darkgate
- Detect DarkGate stealer
- Command and Scripting Interpreter: AutoIT
  Using AutoIT for possible automate script.
  execution
behavioral3 behavioral4
- Target
  
  sqlite3.dll
- Size
  
  1.6MB
- MD5
  
  ce6e163809f5e817ef0c259672f7a1cd
- SHA1
  
  123e2f032b2fc45d6d9fe482756243ed61137476
- SHA256
  
  28ead67d2352ddd11f963e8b23930905ecbaff371162dfdae5ed096f62eb3d79
- SHA512
  
  07766db4cf023bf059415a58a9e1384acb39260ba71587b4eadb99f84d307c0ab70f76390894ab786a6461a0c809f8e9fe435f7bf9b334a369a178c54b295229
- SSDEEP
  
  24576:MxAaWSDRhCekKOe2lwQcRLjVoRRRpGTjSGv2aLtIgS/LfgimS5FE2YIfz:Mljiemj1YdoRRREu3g0gimS5FE21fz
Score

1^/10
behavioral5 behavioral6