Overview

overview

10

Static

static

1

installer.exe

windows7-x64

installer.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    installer.exe

  • Size

    4.0MB

  • Sample

    250208-z4frlawjen

  • MD5

    ea3874838d38c5e9ee97748af1d561cb

  • SHA1

    18cd397a8f1a29585ac2c928fc7da346dae68e91

  • SHA256

    1ffa8b06cb779360f8c42ccd4527ae3076d25d11b3a90976f04ea430173e9b85

  • SHA512

    5f438ab1aeb39dbbb61a825cc6dab21f7420d56c593c80dd4919e9f19bb82aed6856db5b2997bfc0e91249935d1a347d9b0a8a7563ab27cdfeec00d8c69829c1

  • SSDEEP

    49152:aR/KpmZubwf2S8W2ILeWl+C1p9jWy5Snd0eigX+lluBLflz0Lk/rfSxnN3Tz64IB:8/jeYLP1Sy5E0Yplz0Lk/INXUraBA/h

Score
10/10
darkgateuser1discoveryexecutionstealer

Malware Config

Extracted

Family

darkgate

Botnet

user1

C2

91.222.173.149

Attributes
  • anti_analysis

    true

  • anti_debug

    false

  • anti_vm

    true

  • c2_port

    80

  • check_disk

    false

  • check_ram

    false

  • check_xeon

    false

  • crypter_au3

    false

  • crypter_dll

    false

  • crypter_raw_stub

    false

  • internal_mutex

    WaPBitit

  • minimum_disk

    100

  • minimum_ram

    4096

  • ping_interval

    6

  • rootkit

    false

  • startup_persistence

    true

  • username

    user1

Targets

    • Target

      installer.exe

    • Size

      4.0MB

    • MD5

      ea3874838d38c5e9ee97748af1d561cb

    • SHA1

      18cd397a8f1a29585ac2c928fc7da346dae68e91

    • SHA256

      1ffa8b06cb779360f8c42ccd4527ae3076d25d11b3a90976f04ea430173e9b85

    • SHA512

      5f438ab1aeb39dbbb61a825cc6dab21f7420d56c593c80dd4919e9f19bb82aed6856db5b2997bfc0e91249935d1a347d9b0a8a7563ab27cdfeec00d8c69829c1

    • SSDEEP

      49152:aR/KpmZubwf2S8W2ILeWl+C1p9jWy5Snd0eigX+lluBLflz0Lk/rfSxnN3Tz64IB:8/jeYLP1Sy5E0Yplz0Lk/INXUraBA/h

    Score
    10/10
    discoveryexecutiondarkgateuser1stealer

    • DarkGate

      DarkGate is an infostealer written in C++.

      stealerdarkgate

    • Darkgate family

      darkgate

    • Detect DarkGate stealer

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Command and Scripting Interpreter: AutoIT

      Using AutoIT for possible automate script.

      execution
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks