General
-
Target
cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4
-
Size
311KB
-
Sample
221030-yadvgafgb8
-
MD5
a1ae6ded263b40837f428992c07edfdf
-
SHA1
88b2e10d50d28347b177520f568f5cac1e232f13
-
SHA256
cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4
-
SHA512
a755c09cbf241a67b5c722f8486684ecbfbaa8c2503a6dce86514b6306de2968c8a785bb68d2b92cc08c96a06c1b4ae1c0432578b6388d277a17696f6c5574a1
-
SSDEEP
6144:YbjEwsj2WEVIAcKWY3odLteaoV+oqtZGTbv18XgwAnsvNu6aRA1:YJsjaezDp8Yoc+98XunsU6f
Static task
static1
Behavioral task
behavioral1
Sample
cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4.exe
Resource
win10v2004-20220901-en
Malware Config
Extracted
cybergate
2.6
rrrrrrrrrrrrrrrrrrrr
127.0.0.1:288
***MUTEX***
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
svchost.exe
-
install_dir
sssssssssssssss
-
install_file
windows.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
texto da mensagem
-
message_box_title
t?tulo da mensagem
-
password
abcd1234
Targets
-
-
Target
cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4
-
Size
311KB
-
MD5
a1ae6ded263b40837f428992c07edfdf
-
SHA1
88b2e10d50d28347b177520f568f5cac1e232f13
-
SHA256
cda6d356bac8e57db4f61998e0de6bd402782c49dd2912625619503d25a9f5b4
-
SHA512
a755c09cbf241a67b5c722f8486684ecbfbaa8c2503a6dce86514b6306de2968c8a785bb68d2b92cc08c96a06c1b4ae1c0432578b6388d277a17696f6c5574a1
-
SSDEEP
6144:YbjEwsj2WEVIAcKWY3odLteaoV+oqtZGTbv18XgwAnsvNu6aRA1:YJsjaezDp8Yoc+98XunsU6f
-
Adds policy Run key to start application
-
Executes dropped EXE
-
Modifies Installed Components in the registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-