darkgate

General

Target

test.zip
Size

1.8MB
Sample

250327-2elbws1nx4
MD5

4db115907e650e6f46d72d071e7128a6
SHA1

028cef19d1afc134abf870da9dfe75751e9ea246
SHA256

5fb1567d2cbbaf1df7c4ec782f8c9b1a0e1a171bdb6f814f3b3089dab7a03bf4
SHA512

4c98da8cf8ef294eff6c0f8d80f47a5a150f172152130d01550ed8edefb8d1474b69b04051997332040be0633f71c4166b08f621314a2a18fdbd0b8e04244f2b
SSDEEP

49152:f6GRvDtdqwdSo7vBmEOqMEfsr4+SItf0cZ8waS3Lo:f6GRx8DyBmxr9SIac/7o

Score

10^/10

Malware Config

Extracted

Family

darkgate

Botnet

drk3

C2

aspava-yachting.com

Attributes

anti_analysis
false
anti_debug
false
anti_vm
false
c2_port
80
check_disk
false
check_ram
false
check_xeon
false
crypter_au3
false
crypter_dll
false
crypter_raw_stub
false
internal_mutex
ZuMRODIC
minimum_disk
100
minimum_ram
4096
ping_interval
6
rootkit
false
startup_persistence
true
username
drk3

Targets

- Target
  
  test/Autoit3.exe
- Size
  
  872KB
- MD5
  
  c56b5f0201a3b3de53e561fe76912bfd
- SHA1
  
  2a4062e10a5de813f5688221dbeb3f3ff33eb417
- SHA256
  
  237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
- SHA512
  
  195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
- SSDEEP
  
  12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
Score

10^/10

discovery execution darkgate drk3 persistence stealer
- DarkGate
  DarkGate is an infostealer written in C++.
  stealer darkgate
- Darkgate family
  darkgate
- Detect DarkGate stealer
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Adds Run key to start application
  persistence
- Command and Scripting Interpreter: AutoIT
  Using AutoIT for possible automate script.
  execution
behavioral1 behavioral2
- Target
  
  test/SafeService.dll
- Size
  
  3.1MB
- MD5
  
  32fe1ed2b1895b0585423b2627e59c2a
- SHA1
  
  384c0d8208d4321ce6071b796aea3c82a7a49b03
- SHA256
  
  0234d641731bca825dc4d3f45aeff65776af81260d9a1efdbf54f710ff014a85
- SHA512
  
  d6e7866e60931cc9c174ddbb72677b1d053145dc98c627aa8510b137c527dc58e8c04d85702f7d25cee8ab6d50592d9e2ebf6df61506bc5e05bd07fc027717cb
- SSDEEP
  
  49152:dZhL9XR3wxZXRTZUcuVHleFPH1FBJtFfmHrPdvsr:3agbONFom
Score

1^/10
behavioral3 behavioral4
- Target
  
  test/script.a3x
- Size
  
  585KB
- MD5
  
  19c3cd08cdf0b443297669fd94288fb5
- SHA1
  
  89e2519e2a0ff144f99e0f5d7a7419898e36ba77
- SHA256
  
  020740d11c15f7b3b5bbc2eef7e7237c91207089c06573fded479d03ab7f5092
- SHA512
  
  dc4e0b5fc15d5ce65d80792daffd2a8617b3079fd1a7877ca6e3c17cceb518972702b135524c076dd791d032e2f8247632cc43c4d0da296d12e0c38d1b439cc3
- SSDEEP
  
  12288:6cCgZn/cCgZnbWwyQNqi7KwjFfk4RpNBJ7djjWH2y0uc:6cDZn/cDZni5W7KwjiejWjc
Score

3^/10

discovery
behavioral5 behavioral6