General
-
Target
a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085
-
Size
1.1MB
-
Sample
221021-ddn5dshdd7
-
MD5
69ed0a64f4346cfdf3ff58216fea4cb8
-
SHA1
1bd2a03cd1c761d4f70383338abe9ca7c96c5f32
-
SHA256
a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085
-
SHA512
24a918625ba13d71bcfebf1c51994c44e08f8a92538b8dee681241a6fb65ece2401dc0d02e5b245b7f602bd16d63e388f71e395bc5d20e142305e032b0d435c7
-
SSDEEP
24576:UZ8kT+thCoNJ4GycFTQhCoNJ4GycFTDLn:88koNJ4GyAT5oNJ4GyATH
Static task
static1
Behavioral task
behavioral1
Sample
a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085.exe
Resource
win7-20220901-en
Malware Config
Extracted
cybergate
2.6
victima
albertiktn.no-ip.org:81
***egbuiertbi***
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
WinDir
-
install_file
svchost.exe
-
install_flag
false
-
keylogger_enable_ftp
false
-
message_box_caption
texto da mensagem
-
message_box_title
tÃtulo da mensagem
-
password
abcd1234
Targets
-
-
Target
a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085
-
Size
1.1MB
-
MD5
69ed0a64f4346cfdf3ff58216fea4cb8
-
SHA1
1bd2a03cd1c761d4f70383338abe9ca7c96c5f32
-
SHA256
a1d3225fe615eff620faf3b35fe2b04e65cf7160705ce76e85382fc84bca2085
-
SHA512
24a918625ba13d71bcfebf1c51994c44e08f8a92538b8dee681241a6fb65ece2401dc0d02e5b245b7f602bd16d63e388f71e395bc5d20e142305e032b0d435c7
-
SSDEEP
24576:UZ8kT+thCoNJ4GycFTQhCoNJ4GycFTDLn:88koNJ4GyAT5oNJ4GyATH
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-