General
-
Target
18adcf66c78acc3e4d8ad6076f0c281d8238b8bd09db487d81e299f22b757f5c
-
Size
289KB
-
Sample
221021-dgfx7ahee4
-
MD5
53e627594e03f992d1e243b129b39ba7
-
SHA1
a16f3b19b535ee7397c16a1ca925c744604cc081
-
SHA256
18adcf66c78acc3e4d8ad6076f0c281d8238b8bd09db487d81e299f22b757f5c
-
SHA512
9cac530f52274a2bdbf79337db8408aadf2324f48132eb8661bc551aa819211ee886497cca3edb989ea17627ce594945a5e2f86636f04574f0da8c0a6b300fde
-
SSDEEP
6144:COpslFlqChdBCkWYxuukP1pjSKSNVkq/MVJb1:CwslnTBd47GLRMTb1
Behavioral task
behavioral1
Sample
18adcf66c78acc3e4d8ad6076f0c281d8238b8bd09db487d81e299f22b757f5c.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
18adcf66c78acc3e4d8ad6076f0c281d8238b8bd09db487d81e299f22b757f5c.exe
Resource
win10v2004-20220901-en
Malware Config
Extracted
cybergate
v1.07.5
test minecraft pack de texture
loardering.no-ip.org:81
26K5W3HS163Q12
-
enable_keylogger
true
-
enable_message_box
true
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
Microsoft
-
install_file
Windows Update.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
The error is not found
-
message_box_title
Error
-
password
123456
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Targets
-
-
Target
18adcf66c78acc3e4d8ad6076f0c281d8238b8bd09db487d81e299f22b757f5c
-
Size
289KB
-
MD5
53e627594e03f992d1e243b129b39ba7
-
SHA1
a16f3b19b535ee7397c16a1ca925c744604cc081
-
SHA256
18adcf66c78acc3e4d8ad6076f0c281d8238b8bd09db487d81e299f22b757f5c
-
SHA512
9cac530f52274a2bdbf79337db8408aadf2324f48132eb8661bc551aa819211ee886497cca3edb989ea17627ce594945a5e2f86636f04574f0da8c0a6b300fde
-
SSDEEP
6144:COpslFlqChdBCkWYxuukP1pjSKSNVkq/MVJb1:CwslnTBd47GLRMTb1
-
Adds policy Run key to start application
-
Executes dropped EXE
-
Modifies Installed Components in the registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory
-