Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
bc441960140a72b2453ecbe4eb7f7e0a3dbd409459a9684ef24aad58688c0f99
-
Size
428KB
-
Sample
221012-srdyxahbe8
-
MD5
63e06eec91e9cf076b1651ba4cabc4e0
-
SHA1
e2a883452b11b3b8c20b1d89a15a23f0725d4efe
-
SHA256
bc441960140a72b2453ecbe4eb7f7e0a3dbd409459a9684ef24aad58688c0f99
-
SHA512
d88174eabe845ecb7823771beb7b064f39049d50bb86e3f9db2a6a434a6d430f22b8baab5316cd3a95f853839ec3c8e587959acfc2bd9ed9a34d0f600c760831
-
SSDEEP
12288:huMwcBi8vvrHxVPKyv2m77sZB07FxObO32v:hHwd8vrx52t07FQaa
Behavioral task
behavioral1
Sample
bc441960140a72b2453ecbe4eb7f7e0a3dbd409459a9684ef24aad58688c0f99.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
bc441960140a72b2453ecbe4eb7f7e0a3dbd409459a9684ef24aad58688c0f99.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
cybergate
v3.4.2.2
hicham
balikose31.no-ip.info:81
68R12N231P15R2
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
install
-
install_file
server.exe
-
install_flag
false
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
hicham
Targets
-
-
Target
bc441960140a72b2453ecbe4eb7f7e0a3dbd409459a9684ef24aad58688c0f99
-
Size
428KB
-
MD5
63e06eec91e9cf076b1651ba4cabc4e0
-
SHA1
e2a883452b11b3b8c20b1d89a15a23f0725d4efe
-
SHA256
bc441960140a72b2453ecbe4eb7f7e0a3dbd409459a9684ef24aad58688c0f99
-
SHA512
d88174eabe845ecb7823771beb7b064f39049d50bb86e3f9db2a6a434a6d430f22b8baab5316cd3a95f853839ec3c8e587959acfc2bd9ed9a34d0f600c760831
-
SSDEEP
12288:huMwcBi8vvrHxVPKyv2m77sZB07FxObO32v:hHwd8vrx52t07FQaa
Score8/10-
Adds policy Run key to start application
-
Modifies Installed Components in the registry
-