Overview

overview

10

Static

static

1

1ffa8b06cb...85.exe

windows7-x64

7

1ffa8b06cb...85.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1ffa8b06cb779360f8c42ccd4527ae3076d25d11b3a90976f04ea430173e9b85.zip

  • Size

    2.1MB

  • Sample

    250207-mxgzvszkfk

  • MD5

    f0be70f7bd888f5a2d4942221012439d

  • SHA1

    0888f9232072cc98d9699875611eb26abf52461b

  • SHA256

    3c37152f50cdf8113fe57b31133fc738e651eba1fad06b3f30d85dd5731e8f7a

  • SHA512

    484a5f320e755a190506f66c52ef6727dfd67ec01c7b476f68e142ee0319016f8900a809c25d41849306e531370003f997f98d09becbca373541c059219d1823

  • SSDEEP

    49152:txpgiyEddT2KbuwGN5Q0YMvNJKJhqQVx9afB3cr:DWadIy6OyKJhBx8fB3cr

Score
10/10
darkgateuser1discoveryexecutionstealer

Malware Config

Extracted

Family

darkgate

Botnet

user1

C2

91.222.173.149

Attributes
  • anti_analysis

    true

  • anti_debug

    false

  • anti_vm

    true

  • c2_port

    80

  • check_disk

    false

  • check_ram

    false

  • check_xeon

    false

  • crypter_au3

    false

  • crypter_dll

    false

  • crypter_raw_stub

    false

  • internal_mutex

    WaPBitit

  • minimum_disk

    100

  • minimum_ram

    4096

  • ping_interval

    6

  • rootkit

    false

  • startup_persistence

    true

  • username

    user1

Targets

    • Target

      1ffa8b06cb779360f8c42ccd4527ae3076d25d11b3a90976f04ea430173e9b85.exe

    • Size

      4.0MB

    • MD5

      ea3874838d38c5e9ee97748af1d561cb

    • SHA1

      18cd397a8f1a29585ac2c928fc7da346dae68e91

    • SHA256

      1ffa8b06cb779360f8c42ccd4527ae3076d25d11b3a90976f04ea430173e9b85

    • SHA512

      5f438ab1aeb39dbbb61a825cc6dab21f7420d56c593c80dd4919e9f19bb82aed6856db5b2997bfc0e91249935d1a347d9b0a8a7563ab27cdfeec00d8c69829c1

    • SSDEEP

      49152:aR/KpmZubwf2S8W2ILeWl+C1p9jWy5Snd0eigX+lluBLflz0Lk/rfSxnN3Tz64IB:8/jeYLP1Sy5E0Yplz0Lk/INXUraBA/h

    Score
    10/10
    discoveryexecutiondarkgateuser1stealer

    • DarkGate

      DarkGate is an infostealer written in C++.

      stealerdarkgate

    • Darkgate family

      darkgate

    • Detect DarkGate stealer

    • Executes dropped EXE

    • Loads dropped DLL

    • Command and Scripting Interpreter: AutoIT

      Using AutoIT for possible automate script.

      execution
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks