darkgate | b8a001db62d2222f2fa9bb895a2f2547efeb6a361576db1189e4daa52302e334

General

Target
jaffacakes118_sideloading.zip
Size 2.3MB
Sample260910-gy7c9azapf
SHA256 b8a001db62d2222f2fa9bb895a2f2547efeb6a361576db1189e4daa52302e334
MD5 95f0fef3c92eca4e5ca72c2a28f8cf1d
SHA1 597b35b9e9e8bb45fd458610e2c6592f4846d2e3
SHA512 3dd245c656c706631ad47e5a22644fa4bf325edc04e746044639d0723bf7aafeaa1d153015a91da6b0ea405f1fe0cf1dde3f978d64a353f596343ce4a2594abd
SSDEEP 49152:kxhNiZun3EoG9L3pcm/O8En1vsswW86MO0vd7FjIvNxIB/uXsdMT3W/wg1jk:kxhN2unfGJ3pcmW8En1/vnqF7FmjuIsY
TLSH
T11BB533CA4760A4D1B293CD2877571F85A6F9E96F4F89BC7C5C0895F240326A36783B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

darkgate

Botnet

admin888

C2

prodomainnameeforappru.com

Attributes

anti_analysis
true
anti_debug
false
anti_vm
true
c2_port
443
check_disk
true
check_ram
false
check_xeon
false
crypter_au3
false
crypter_dll
false
crypter_raw_stub
false
internal_mutex
VzXLKSZE
minimum_disk
50
minimum_ram
7000
ping_interval
6
rootkit
false
startup_persistence
true
username
admin888

Targets

- Target
  sideloading/CoreFoundation.dll
- Size 3.6MB
- SHA256 f049356bb6a8a7cd82a58cdc9e48c492992d91088dda383bd597ff156d8d2929
- MD5 3b81ffed1e2d61f739bb241e395ce563
- SHA1 ce08355cb95ab3d1ad177eb641acfa0339ce73d4
- SHA512 06ee1ca4b102d90bd1390c9e7fefecfa7fd8ebc131a8fd24d76a0aa51655cb254b021ba05ca976910395c08658171f0f8c1f6b1fec0fbc6c9ec5b906fddb606d
- SSDEEP 49152:psh68THDmkeHoBN8SEsdV+5J+2D8/Ttg8:EkbDi
- TLSH
  T1E706387F62A58AB9C11ED33EC0A38B01D433B4BA1773C6E74391826A5E169D55E7F320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  sideloading/iTunesHelper.exe
- Size 358KB
- SHA256 0d8878cca08903777888b3681f90e4a07c7aef7d9600a67dfa985844d4bf5eda
- MD5 ed6a1c72a75dee15a6fa75873cd64975
- SHA1 67a15ca72e3156f8be6c46391e184087e47f4a0d
- SHA512 256c2ebfeb42c2d3340d8bb423ef0ae48d5fb9fe5ca09c363595f51a03007482b67a777e4cae7a8194f69bc3a3fbcdb9abb5c9f92097925272431bb9d50f5c03
- SSDEEP 6144:TjZtNtzxEFQVLEhZbblN4W6ZDNFfEai23+FM2+zIv+98vS:ZRxMQLEhZXybF8Ut4o8a
- TLSH
  T1F474AD45B7A00CF9FD6B823D8D92860AE67378550760C7DF03A442AB5F237D16E3AB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

admin888 discovery execution darkgate persistence stealer
- Detect DarkGate stealer
- Family: DarkGate
  DarkGate is an infostealer written in C++.
  stealer darkgate
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Uses the VBS compiler for execution
- Adds Run key to start application
  persistence
- Command and Scripting Interpreter: AutoIT
  Using AutoIT for possible automate script.
  execution
behavioral3 behavioral4
- Target
  sideloading/sqlite3.dll
- Size 1.6MB
- SHA256 17158c1a804bbf073d7f0f64a9c974312b3967a43bdc029219ab62545b94e724
- MD5 0f64a8b96eee3823ec3a1bfe253e82be
- SHA1 e47acbb2fb97d05ce5222ba2737a5b0c0f039a0c
- SHA512 4d08d96bfe4ed497ca01d6f76acf1f5138d775b56556923b24e1e86cbd26fd54b6f517c8d3211b80332f90fe46cb77e347280636dc984ded2da8842aff9a5f43
- SSDEEP 24576:OIFF9cuF6HvflagqDd2wbDsUNK2elPOC2cjI+K3AC/eF5DUONurprlYI:NFF9cHvwgqPboUVeBd2cI+NnFGpJYI
- TLSH
  T1FD75AEB1C61EF690781EFC871F3C5FCB110C6B11AEECABC089696A9D491D3B485E524E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6