Overview

overview

10

Static

static

1

report to ...er.exe

windows7-x64

7

report to ...er.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    reporttokaspersky.zip

  • Size

    2.1MB

  • Sample

    250207-n7b22azkbt

  • MD5

    ceba22dc57178aaa308620172005e785

  • SHA1

    0e21f625ef51c2e9125ab5bd7da3960888c0d571

  • SHA256

    4a0db93e60a878891a169c2b0b5a400d974cdf3e985a2f70896836d2cb6a8e11

  • SHA512

    4514824f4aaa9dff1989a4d636fb6b45b12f49b3d47dacdaf9783d7e180cf7f1c74530df4e8153ada5b84675213d40e4fda5d4f0bc98072d10a6357333f748bb

  • SSDEEP

    49152:zL43RkjHKqoFqH51PxLOxqjgEjePMGXXCZjpEiRA7rvgzY:34BZkhxLOxWBBGHypEuAPgk

Score
10/10
darkgateuser1discoveryexecutionstealer

Malware Config

Extracted

Family

darkgate

Botnet

user1

C2

91.222.173.149

Attributes
  • anti_analysis

    true

  • anti_debug

    false

  • anti_vm

    true

  • c2_port

    80

  • check_disk

    false

  • check_ram

    false

  • check_xeon

    false

  • crypter_au3

    false

  • crypter_dll

    false

  • crypter_raw_stub

    false

  • internal_mutex

    WaPBitit

  • minimum_disk

    100

  • minimum_ram

    4096

  • ping_interval

    6

  • rootkit

    false

  • startup_persistence

    true

  • username

    user1

Targets

    • Target

      report to kaspersky/installer.exe

    • Size

      4.0MB

    • MD5

      ea3874838d38c5e9ee97748af1d561cb

    • SHA1

      18cd397a8f1a29585ac2c928fc7da346dae68e91

    • SHA256

      1ffa8b06cb779360f8c42ccd4527ae3076d25d11b3a90976f04ea430173e9b85

    • SHA512

      5f438ab1aeb39dbbb61a825cc6dab21f7420d56c593c80dd4919e9f19bb82aed6856db5b2997bfc0e91249935d1a347d9b0a8a7563ab27cdfeec00d8c69829c1

    • SSDEEP

      49152:aR/KpmZubwf2S8W2ILeWl+C1p9jWy5Snd0eigX+lluBLflz0Lk/rfSxnN3Tz64IB:8/jeYLP1Sy5E0Yplz0Lk/INXUraBA/h

    Score
    10/10
    discoveryexecutiondarkgateuser1stealer

    • DarkGate

      DarkGate is an infostealer written in C++.

      stealerdarkgate

    • Darkgate family

      darkgate

    • Detect DarkGate stealer

    • Executes dropped EXE

    • Loads dropped DLL

    • Command and Scripting Interpreter: AutoIT

      Using AutoIT for possible automate script.

      execution
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks