DarkGate Loader IOCs - Part 6

DarkGate, впервые задокументированный в 2018 году, представляет собой товарный загрузчик с функциями, включающими возможность загрузки и выполнения файлов в памяти, модуль HVNC (Hidden Virtual Network Computing), кейлоггинг, возможность кражи информации и повышение привилегий. DarkGate использует легитимные файлы AutoIt и, как правило, запускает несколько AutoIt-скриптов.

Table of Contents

Indicators of Compromise

Domains

alriyada.edu.sa
canvasfisd.info
educonix.com
endeavourservices.com.au
gentzhull.co.uk
homemadetohome.com
hys.com.co
infocuankerajaan.co
ittrainingbd.com
josemiguelescribano.com
lacasayelcampoinmobiliaria.com
leae.com
menvm.com
mhimedicalbilling.com
rtp-kapuas88.info
siddiquieenterprisesllc.com
solutionforum.au
suppliededucation.co.uk
synagoguetv.org
taxiinmecca.com

Domain Port Combinations

eugelens.com:2351

URLs

http://eugelens.com:2351/
http://eugelens.com:2351/ipmyfu
http://eugelens.com:2351/zqgfgn
http://prestige-castom.com:2351
http://prestige-castom.com:2351/
http://prestige-castom.com:2351/gqcsfd
http://prestige-castom.com:2351/msirzgnzamg
https://alriyada.edu.sa/meq/?NZlkiomiOBvyFOGhhsnZpLpfXvFBsqdhBiiPuSybICfPCzTElCcUPyDpUfFCSlYmSiHuwAfzNkmryyaVnrVxnHvzg
https://canvasfisd.info/ma//?redir=1696886499
https://canvasfisd.info/ma/?cp=188955
https://educonix.com/tuq//?redir=1696961602
https://educonix.com/tuq/?G=4320350
https://endeavourservices.com.au/is/?7K=7248370
https://gentzhull.co.uk/cln/?CUyRhSHDAbxwSHCsMBGmfmipLQga
https://homemadetohome.com/ter/?AiQsxvyhdpDTOXpyXjTjqKDwZBHcUoxvJtZQMfMPGRZoJDHONQesjDbyMBpeFIFrYVgEjHKniQMqJbsQ
https://hys.com.co/istu//?redir=1696886534
https://hys.com.co/istu/?EV=7224321
https://infocuankerajaan.co/lt//?redir=1696886527
https://infocuankerajaan.co/lt/?4=8471886
https://ittrainingbd.com/pro/?zxEiGRcJFDMRoicmeAfEDLTLlVEhPePRwiDWaEmrRoVpeohusKLeQvcUrDAtmlNhBOjFWtBr
https://josemiguelescribano.com/uea/?qOmokqHCjbl
https://lacasayelcampoinmobiliaria.com/orip//?redir=1696886597
https://lacasayelcampoinmobiliaria.com/orip/?1R=1497553
https://leae.com/b9/?q=4231278
https://menvm.com/BZcoF/?o=4389164
https://mhimedicalbilling.com/eusa/?iTjoEsjkngtHscTkzOmCiBNGfhRnwSMzaaay
https://rtp-kapuas88.info/tr//?redir=1696886558
https://rtp-kapuas88.info/tr/?a=1386199
https://siddiquieenterprisesllc.com/ootp/?3=6135532
https://solutionforum.au/ics/?OY=2607269
https://suppliededucation.co.uk/uoic//?redir=1696886507
https://suppliededucation.co.uk/uoic/?ou=1840026
https://synagoguetv.org/spov/?L=1170188
https://taxiinmecca.com/ttoa/?m=9264691

Emails

MD5

11455c13b7b6e90e9a6280ce4031f237
115930aa45778dfca71b39efdc6f66a1
151711041ee1619088258f05a5d3bd5b
17885adbad12b5651601682aa4e12473
1b6f948f740eb0426204a9b15472b194
1b9b8fe62cc708c9a625ee2eb0af21d3
1bb0d6410b8e3b9a6c48b9556e954aee
1ce9c28c75d7cfe28f3296e6c4c81bb4
1ddcfa52d781f75190c18c48e9645b63
1feda574e4345a447efd0990298bb7b2
246150a005bcc84b8f44a0dafd98a2b8
2a54e3272c13793cd51b1aa5c6095319
2b1fdee02aec0b42603d55416da62234
2dc18898dd830b314bad84a633586f42
2f177c78c1c42e502edf1a8c9197c17f
3750edd59d78a01969aa3d2d384e427d
386b777c17965d06fee89b2bced12310
388e46c2fda4ec434ee7302534d652a8
3bbfa9789b803850926a25c560e27a70
430f8c42df0bf151978fe0162addd4a0
5098e8cdd54b1856fb927576b47433be
5a946d7dab96c7a70fff155da1eee9b4
5b566a2fb111b4f5ee6dce4cf677bbda
5c2143dbf320fd30a4547f822d028c12
68f5c651f1597d1eb321e83292d2cf0e
6d67a67e682f406ea79607f0b0acc60a
6deab79c1b18f48aea22eeac17f52b1c
6feb6b306c1be1d23340e3d9d800b432
72ba4333496a48ab2c8e97a985583ad1
757f87b1384cff5a375789cf44b6a15b
7614612bada21ee95a7a257628525f02
7a3daf79bfc9ae2744d3a80b9bb2428d
853a38ef7686b5e928bf01a3a690fa5a
8bcef0d60d9fb3d0e3e817fa934fe035
8e68a2869daf1ba9eaebf31d2d87973e
9042bdae2b1cebf679c8657958d26dc3
925f867dc665b9abfd6e44763f18d03d
9937e645b25ca3a99f2ad85e0398cfcd
9ed29c10ce83535150328f50cf13d030
a1201133669a4cf29f54281463cbee38
a553c647310fdab1f602287e4b964402
afa815516bea6a8552064960793ab5a2
b258b45a8ec299c18166123f5b927cb8
bec3e98e02fb84505c2addb9b5651c43
c56b5f0201a3b3de53e561fe76912bfd
c7472109433706d9f2a05a321af0db11
c7c11f951f8459db590e77bc75c27861
ce749d40b867f85689d2968cf7e405e2
d30456afdff93fe362b6317a32079196
d7ac8f6929e817961feff9f965d2b839
d96535591fd48672a10a1173101ce065
deb30961cc91d2924f50403a9a8c6f0c
e30e5d10f51d5036fdf85b476fb99f69
e4538a585abf07b8c86b16a8b22de906
e63524dcfe29147ed52dfb72f1acd8c5
e6f7f221b81133815ff9355ab46833a0
ed8e8cde348ef96055e855d571a51f7e
eec22ffd6d61b5fbd6f8e787e6661c30
f00e65541eb90dd0fc70ef5064f6dc48
f582da8fcd0ce80630ebe8026a8bcb81
f8b821865a90686126b57e6c14c1b5d9
f9029fc6e1e732db097c88eca7f49189
fd458732261c6f528d09033041b29786