darkgate | eae61d3093991200cb100245e741a3fd12731c037dc238638699fc6207484fa8

General

Target
2312496895E9DB868D41EDAC40157D8D
Size 416KB
Sample251230-g3m56stjfx
SHA256 eae61d3093991200cb100245e741a3fd12731c037dc238638699fc6207484fa8
MD5 2312496895e9db868d41edac40157d8d
SHA1 166ac5ac5254624ec027b21ae097fbf4f2dabb3b
SHA512 dab60bedbb2ba8ae4fec80194a5ff3017024b09b47ae0d7faa25569f104e81773a638b0341e89a978781625d3395646e61aceb8dec3b7c3a9329d624d506ca21
SSDEEP 6144:OydxRrk2CbW7/Bbft9mpQQAoLP2WFXCJeZdHLELt8JvKzamrvn1qcE:OgxVk9bW9f3SQQAodXBdHLELSeaiu
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

darkgate

Version

5.2.4

Botnet

anykey

C2

http://investmentsystems.top
http://oneinvestmentstudio.top

Attributes

alternative_c2_port
8080
anti_analysis
true
anti_debug
true
anti_vm
true
c2_port
80
check_disk
true
check_ram
true
check_xeon
true
crypter_au3
false
crypter_dll
false
crypter_raw_stub
true
crypto_key
vvhuNsXopqlxUv
internal_mutex
txtMut
minimum_disk
100
minimum_ram
3584
ping_interval
16
rootkit
true
startup_persistence
true
username
anykey

Targets

- Target
  2312496895E9DB868D41EDAC40157D8D
- Size 416KB
- SHA256 eae61d3093991200cb100245e741a3fd12731c037dc238638699fc6207484fa8
- MD5 2312496895e9db868d41edac40157d8d
- SHA1 166ac5ac5254624ec027b21ae097fbf4f2dabb3b
- SHA512 dab60bedbb2ba8ae4fec80194a5ff3017024b09b47ae0d7faa25569f104e81773a638b0341e89a978781625d3395646e61aceb8dec3b7c3a9329d624d506ca21
- SSDEEP 6144:OydxRrk2CbW7/Bbft9mpQQAoLP2WFXCJeZdHLELt8JvKzamrvn1qcE:OgxVk9bW9f3SQQAodXBdHLELSeaiu
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral1
- Target
  77c4a4c4a9c229a1a7b97684aeb0b59e1350da9260430d9a61cb1df03347b359
- Size 416KB
- SHA256 77c4a4c4a9c229a1a7b97684aeb0b59e1350da9260430d9a61cb1df03347b359
- MD5 ad46cab79cc01ac974fcf19887d667d4
- SHA1 d263b59891180227c183b8596076975ba4e01967
- SHA512 4f1caecea48cb922c3cc6239949998a53bba4db9d922283d116dd1c1ea7073b9fd0bf4fc91116314981594cf876c33f42ef570bba324d0d30396b789cf89572e
- SSDEEP 6144:9ydxRrk2CbW7/Bbft9mpQQAoLP2WFXCJeZdHLELt8JvKzamrvn1q:9gxVk9bW9f3SQQAodXBdHLELSeai
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral2
- Target
  77c4a4c4a9c229a1a7b97684aeb0b59e1350da9260430d9a61cb1df03347b359_info.txt
- Size 416B
- SHA256 23f241f6e18619e8dbb5e91889cf46f8095914e7db7e9a2cfc33f278bc5b3553
- MD5 587e49f963d1477a9fdf65a63e8b9e55
- SHA1 a99117c1afcf5babe3b5610938dbaf854cfb1c1e
- SHA512 f7a745dc0c6e260b25ebe64c2d3d6bef2cb784fc4d1f9dcedfee0aad89590b0127084496fd21222a16f2840ebc40f996ae5b412e8dc04c4d3715921dbf7e3546
- MD5 SHA1 SHA512
Score

1^/10

ransomware
behavioral3

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Extracted

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3