General
-
Target
7ef3459e2301d681112b3c4a0990847a9892ac73ecb543f5651a3dc54181f2bf
-
Size
323KB
-
Sample
221021-z27gjagban
-
MD5
6d4500ed91b79c0a6de774cc17714ab6
-
SHA1
7c46f523c5061a7d743d024c3a3be317724f596c
-
SHA256
7ef3459e2301d681112b3c4a0990847a9892ac73ecb543f5651a3dc54181f2bf
-
SHA512
2363704b21b417fdcdfbd9633b481e3bf862214c67b361d1f88292817647ad19d22666adba06f1df3c59f1fbe9074240af63e874a20985cc384a5a0eb14a9c00
-
SSDEEP
6144:2n5d5OwiK0nDN79Y+nLlmpjbRQUn+MFn21Ek5HD5HCSnhFJWI/TrHEznset50WBA:KDirnRRupXRb21EmwAcQTLEzsU/W
Static task
static1
Behavioral task
behavioral1
Sample
7ef3459e2301d681112b3c4a0990847a9892ac73ecb543f5651a3dc54181f2bf.exe
Resource
win7-20220812-en
Malware Config
Extracted
cybergate
v1.07.5
AhoIII
ahjoderahoijo.no-ip.biz:100
57R6R2I887C065
-
enable_keylogger
false
-
enable_message_box
true
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
cookies
-
install_file
server.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
.NET Framework Initialization Error: C:\WINDOWS\ Microsoft.NET\Framework\v 1.1.4322\Mscorwks.dll could not be loade.
-
message_box_title
ERROR
-
password
123456
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Targets
-
-
Target
7ef3459e2301d681112b3c4a0990847a9892ac73ecb543f5651a3dc54181f2bf
-
Size
323KB
-
MD5
6d4500ed91b79c0a6de774cc17714ab6
-
SHA1
7c46f523c5061a7d743d024c3a3be317724f596c
-
SHA256
7ef3459e2301d681112b3c4a0990847a9892ac73ecb543f5651a3dc54181f2bf
-
SHA512
2363704b21b417fdcdfbd9633b481e3bf862214c67b361d1f88292817647ad19d22666adba06f1df3c59f1fbe9074240af63e874a20985cc384a5a0eb14a9c00
-
SSDEEP
6144:2n5d5OwiK0nDN79Y+nLlmpjbRQUn+MFn21Ek5HD5HCSnhFJWI/TrHEznset50WBA:KDirnRRupXRb21EmwAcQTLEzsU/W
-
Adds policy Run key to start application
-
Executes dropped EXE
-
Modifies Installed Components in the registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-