Overview

overview

10

Static

static

3

installer.exe

windows7-x64

installer.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    installer.exe

  • Size

    4.0MB

  • Sample

    250208-1ezc3svmby

  • MD5

    72b68bfac010ae63e27664861e1c75fa

  • SHA1

    9e3e0dd6a8d2f162a48bf4fd769b506f5850f3eb

  • SHA256

    4417ff02be98035b74555c610fd564d5440373972bdb97b026122adf5d989852

  • SHA512

    ffc626c3fedcbaf1ad674eae0cf5fe532af720a0e1a5a53b5bae094481d6b327d5468c9c8da9c1d31908c24d9be4fa1d4028b6ae36e9f3f6614f2a8783ef0ab9

  • SSDEEP

    49152:aR/KpmZubwf2S8W2ILeWl+C1p9jWy5Snd0eigX+lluBLflz0Lk/rfSxnN3Tz64IY:8/jeYLP1Sy5E0Yplz0Lk/INXUraBA/4

Score
10/10
darkgateuser1discoveryexecutionstealer

Malware Config

Extracted

Family

darkgate

Botnet

user1

C2

91.222.173.149

Attributes
  • anti_analysis

    true

  • anti_debug

    false

  • anti_vm

    true

  • c2_port

    80

  • check_disk

    false

  • check_ram

    false

  • check_xeon

    false

  • crypter_au3

    false

  • crypter_dll

    false

  • crypter_raw_stub

    false

  • internal_mutex

    WaPBitit

  • minimum_disk

    100

  • minimum_ram

    4096

  • ping_interval

    6

  • rootkit

    false

  • startup_persistence

    true

  • username

    user1

Targets

    • Target

      installer.exe

    • Size

      4.0MB

    • MD5

      72b68bfac010ae63e27664861e1c75fa

    • SHA1

      9e3e0dd6a8d2f162a48bf4fd769b506f5850f3eb

    • SHA256

      4417ff02be98035b74555c610fd564d5440373972bdb97b026122adf5d989852

    • SHA512

      ffc626c3fedcbaf1ad674eae0cf5fe532af720a0e1a5a53b5bae094481d6b327d5468c9c8da9c1d31908c24d9be4fa1d4028b6ae36e9f3f6614f2a8783ef0ab9

    • SSDEEP

      49152:aR/KpmZubwf2S8W2ILeWl+C1p9jWy5Snd0eigX+lluBLflz0Lk/rfSxnN3Tz64IY:8/jeYLP1Sy5E0Yplz0Lk/INXUraBA/4

    Score
    10/10
    discoveryexecutiondarkgateuser1stealer

    • DarkGate

      DarkGate is an infostealer written in C++.

      stealerdarkgate

    • Darkgate family

      darkgate

    • Detect DarkGate stealer

    • Executes dropped EXE

    • Loads dropped DLL

    • Command and Scripting Interpreter: AutoIT

      Using AutoIT for possible automate script.

      execution
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks