General
-
Target
1721ad25b36877f56167cf1ed63d7abe98f61068705610526a384801882651c4
-
Size
399KB
-
Sample
221021-xrwk6sbdg5
-
MD5
2b2517dfc2c8dd6fd3dcdbc45e718ab1
-
SHA1
f0d6df40645d1d057c4bf4ba8667e5c3d953555a
-
SHA256
1721ad25b36877f56167cf1ed63d7abe98f61068705610526a384801882651c4
-
SHA512
62934c38e7e8396067cf2ab196c6fbecf8968f1deaf2b6c08041465103e1936a4317354bd4f8ed81aff841e199f508512e1ef8b1887d3387d6d2e86d43e85fcd
-
SSDEEP
12288:bMf36VjJai92H7il6lNJdmSPOh1vxiAR:bPjEi2ii3mWOh1vx
Static task
static1
Behavioral task
behavioral1
Sample
1721ad25b36877f56167cf1ed63d7abe98f61068705610526a384801882651c4.exe
Resource
win7-20220812-en
Malware Config
Extracted
cybergate
2.6
ÖÍíÉ
Dr-Ghost.dnsd.info:288
***MUTEX***
-
enable_keylogger
false
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
svchost.exe
-
install_file
svchoost.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
texto da mensagem
-
message_box_title
t?tulo da mensagem
-
password
abcd1234
-
regkey_hkcu
msnmsgr
-
regkey_hklm
msnmsgr
Targets
-
-
Target
1721ad25b36877f56167cf1ed63d7abe98f61068705610526a384801882651c4
-
Size
399KB
-
MD5
2b2517dfc2c8dd6fd3dcdbc45e718ab1
-
SHA1
f0d6df40645d1d057c4bf4ba8667e5c3d953555a
-
SHA256
1721ad25b36877f56167cf1ed63d7abe98f61068705610526a384801882651c4
-
SHA512
62934c38e7e8396067cf2ab196c6fbecf8968f1deaf2b6c08041465103e1936a4317354bd4f8ed81aff841e199f508512e1ef8b1887d3387d6d2e86d43e85fcd
-
SSDEEP
12288:bMf36VjJai92H7il6lNJdmSPOh1vxiAR:bPjEi2ii3mWOh1vx
-
Adds policy Run key to start application
-
Executes dropped EXE
-
Modifies Installed Components in the registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-