General
-
Target
e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755
-
Size
334KB
-
Sample
221011-cbc4nshhf3
-
MD5
027bfefca562470107ba1a45b9037c16
-
SHA1
e3c508fa63b5df2420a750cf198f6862311ca400
-
SHA256
e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755
-
SHA512
6b584e82593ccb42b864ec8e9011694786ed3e71d06c611250011b8567d29ae854f488457d8d3e9a50190797175fee6cec2cffbabe817bf6b058e9038235709e
-
SSDEEP
6144:2I91jrxoMg+ozTEUvX2WEfd+3Un9KF/4CpPgQeMF+:3tbg7TvRId1PCpPgQeMg
Static task
static1
Behavioral task
behavioral1
Sample
e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755.exe
Resource
win10v2004-20220901-en
Malware Config
Extracted
cybergate
2.6
Victima
85.137.57.212:58
adobe.exe
-
enable_keylogger
true
-
enable_message_box
true
-
ftp_directory
./www/logs/
-
ftp_interval
5
-
injected_process
explorer.exe
-
install_dir
Adobe
-
install_file
adobe.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
El archivo amtlib.dll no está instalado en el sistema.
-
message_box_title
Error de DLL
-
password
159951
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Targets
-
-
Target
e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755
-
Size
334KB
-
MD5
027bfefca562470107ba1a45b9037c16
-
SHA1
e3c508fa63b5df2420a750cf198f6862311ca400
-
SHA256
e36d618550f8bd38a94e309d3e5d96bae469dd2a9bd442170e1439fb27fba755
-
SHA512
6b584e82593ccb42b864ec8e9011694786ed3e71d06c611250011b8567d29ae854f488457d8d3e9a50190797175fee6cec2cffbabe817bf6b058e9038235709e
-
SSDEEP
6144:2I91jrxoMg+ozTEUvX2WEfd+3Un9KF/4CpPgQeMF+:3tbg7TvRId1PCpPgQeMg
-
Adds policy Run key to start application
-
Executes dropped EXE
-
Modifies Installed Components in the registry
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-