darkgate

General

Target

test.zip
Size

3.3MB
Sample

250402-z4sq6attg1
MD5

60ca0e7867c14d585e58784ed1370bcf
SHA1

94203c1e60001169f16d82163984bd3cda2b5b43
SHA256

ff2f51fa09448e0ede9ced3abf33809e1f9c79c7569294a67a7d58fc6f32593b
SHA512

9580f1921fceaa63f21946a021e2900b443067997e0d673211efca2ba89abdb3bb012ac9c19908deacf072986e7a0193ac6d40582a743bfdbacd450033fa3fb7
SSDEEP

49152:G6GRvDtdqwdSo7vBmQOqMEfsr4+SIzf0cZ8waS3LiCulyHXYbeSs6Ge1MsboA1g:G6GRx8DyBmNr9SIAc/7iNH1NzboA2

Score

10^/10

Malware Config

Extracted

Family

darkgate

Botnet

drk3

C2

aspava-yachting.com

Attributes

anti_analysis
false
anti_debug
false
anti_vm
false
c2_port
80
check_disk
false
check_ram
false
check_xeon
false
crypter_au3
false
crypter_dll
false
crypter_raw_stub
false
internal_mutex
ZuMRODIC
minimum_disk
100
minimum_ram
4096
ping_interval
6
rootkit
false
startup_persistence
true
username
drk3

Targets

- Target
  
  test/ActiveSync.exe
- Size
  
  3.7MB
- MD5
  
  d9ab5ec0952f1927aa013a9fb92d154e
- SHA1
  
  0f956f83b3db92b8017ef9450bf97c2bb0c170ab
- SHA256
  
  5f73318a2f599782b3f74cac4b200d0bd19ca7083551643db6972704992e8005
- SHA512
  
  be22fe9f0e6f121214720b6c4b6ac86b6edc3d8b75a65b9c0cb82ccd18c6baa6dde05b8d6b6b39046ebe2ef20c254a0a05d624c700c877d4221b381be6281dcc
- SSDEEP
  
  49152:k1JkqNY5gjjwtvJ6D4qYjE2DfOzcOzxAfEQjCsnrBU54+ZKlBtvtMt0+Jf1Gzyyi:k1JkqNYWjk6M3DfOzcOpcCsrBU54+mL
Score

10^/10

darkgate drk3 discovery execution persistence stealer
- DarkGate
  DarkGate is an infostealer written in C++.
  stealer darkgate
- Darkgate family
  darkgate
- Detect DarkGate stealer
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Command and Scripting Interpreter: AutoIT
  Using AutoIT for possible automate script.
  execution
behavioral1
- Target
  
  test/Autoit3.exe
- Size
  
  872KB
- MD5
  
  c56b5f0201a3b3de53e561fe76912bfd
- SHA1
  
  2a4062e10a5de813f5688221dbeb3f3ff33eb417
- SHA256
  
  237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
- SHA512
  
  195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
- SSDEEP
  
  12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
Score

3^/10

discovery
behavioral2
- Target
  
  test/SafeService.dll
- Size
  
  3.1MB
- MD5
  
  32fe1ed2b1895b0585423b2627e59c2a
- SHA1
  
  384c0d8208d4321ce6071b796aea3c82a7a49b03
- SHA256
  
  0234d641731bca825dc4d3f45aeff65776af81260d9a1efdbf54f710ff014a85
- SHA512
  
  d6e7866e60931cc9c174ddbb72677b1d053145dc98c627aa8510b137c527dc58e8c04d85702f7d25cee8ab6d50592d9e2ebf6df61506bc5e05bd07fc027717cb
- SSDEEP
  
  49152:dZhL9XR3wxZXRTZUcuVHleFPH1FBJtFfmHrPdvsr:3agbONFom
Score

1^/10
behavioral3
- Target
  
  test/script.a3x
- Size
  
  585KB
- MD5
  
  19c3cd08cdf0b443297669fd94288fb5
- SHA1
  
  89e2519e2a0ff144f99e0f5d7a7419898e36ba77
- SHA256
  
  020740d11c15f7b3b5bbc2eef7e7237c91207089c06573fded479d03ab7f5092
- SHA512
  
  dc4e0b5fc15d5ce65d80792daffd2a8617b3079fd1a7877ca6e3c17cceb518972702b135524c076dd791d032e2f8247632cc43c4d0da296d12e0c38d1b439cc3
- SSDEEP
  
  12288:6cCgZn/cCgZnbWwyQNqi7KwjFfk4RpNBJ7djjWH2y0uc:6cDZn/cDZni5W7KwjiejWjc
Score

3^/10
behavioral4