darkgate

General

Target

gacdeca.zip
Size

808KB
Sample

250328-mh1hnawqz9
MD5

322d0da06a21db24694cffc5dbe04712
SHA1

d59b9139f24f8ea6f81bdc8915cd88cf8156dd0b
SHA256

d92024a4c81073d013ee65310350714f0daa216bc90c7d4b43031cb9c72c23d2
SHA512

e7b4cb18ca70e26ad9ef18fe5af595a5920223ee0de656b9f4b25d419320f864c4ae3a5625485b9b91d4e117eb27a9aba0b0c8c77dc6e1179b32895f450ca483
SSDEEP

24576:kEOqI3EfJSrKw5pW+yGSIRzinfQvcLdv0waS3c21/P:bOqMEfsr4+SIef0cZ8waS3LP

Score

10^/10

Malware Config

Extracted

Family

darkgate

Botnet

drk3

C2

aspava-yachting.com

Attributes

anti_analysis
false
anti_debug
false
anti_vm
false
c2_port
80
check_disk
false
check_ram
false
check_xeon
false
crypter_au3
false
crypter_dll
false
crypter_raw_stub
false
internal_mutex
ZuMRODIC
minimum_disk
100
minimum_ram
4096
ping_interval
6
rootkit
false
startup_persistence
true
username
drk3

Targets

- Target
  
  gacdeca/Autoit3.exe
- Size
  
  872KB
- MD5
  
  c56b5f0201a3b3de53e561fe76912bfd
- SHA1
  
  2a4062e10a5de813f5688221dbeb3f3ff33eb417
- SHA256
  
  237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
- SHA512
  
  195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
- SSDEEP
  
  12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
Score

10^/10

darkgate drk3 discovery persistence stealer
- DarkGate
  DarkGate is an infostealer written in C++.
  stealer darkgate
- Darkgate family
  darkgate
- Detect DarkGate stealer
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Adds Run key to start application
  persistence
behavioral1 behavioral2
- Target
  
  gacdeca/ehcgdaf
- Size
  
  54B
- MD5
  
  16858c154c8696c19d3e785bf23e3b38
- SHA1
  
  20f1e230135f6d87378cacf0a00bec78bc58a258
- SHA256
  
  940290647041aa29ae435efe96aa036fbc1872fab9a38079a0788ff9a51a9bba
- SHA512
  
  10e4c86f0c6ff604a06318b8f1d3ad65249058168058c3648bea1cbb9b25b8fe996a8babeebce47fd1518be33ce2bf8dfdef628c2066186f11aaf80d3acfc141
Score

1^/10
behavioral3 behavioral4
- Target
  
  gacdeca/ekfgefa.a3x
- Size
  
  585KB
- MD5
  
  19c3cd08cdf0b443297669fd94288fb5
- SHA1
  
  89e2519e2a0ff144f99e0f5d7a7419898e36ba77
- SHA256
  
  020740d11c15f7b3b5bbc2eef7e7237c91207089c06573fded479d03ab7f5092
- SHA512
  
  dc4e0b5fc15d5ce65d80792daffd2a8617b3079fd1a7877ca6e3c17cceb518972702b135524c076dd791d032e2f8247632cc43c4d0da296d12e0c38d1b439cc3
- SSDEEP
  
  12288:6cCgZn/cCgZnbWwyQNqi7KwjFfk4RpNBJ7djjWH2y0uc:6cDZn/cDZni5W7KwjiejWjc
Score

3^/10
behavioral5 behavioral6
- Target
  
  gacdeca/hffkdhf
- Size
  
  1KB
- MD5
  
  737383638a5494a189e6a63d20a8944a
- SHA1
  
  d0c79f42d5c47f60f116973c499690194c4df3a2
- SHA256
  
  24a639d2f64cbe8d08e96c19bd37d41cc1ea738b5d01294209069d2aabeb46b8
- SHA512
  
  79efa00533f6a8235772f5bd7e253a3b3299929dc0a8c6adbadf3abc19804e9ab9c9e51ff5ffb488d076daffb86f2ef4083b74966bba04f1ebd6deb52f6c360f
Score

1^/10
behavioral7 behavioral8