General
-
Target
fb7847373477a5148f190949c130977367bfee8c854811ee96381a6cbc54ac4d
-
Size
365KB
-
Sample
221106-hj53bagfb7
-
MD5
211f5b91e02cce9155adcbb0ad9233f0
-
SHA1
2a04655504ec02036e750aa8c3aff776df9b7b14
-
SHA256
fb7847373477a5148f190949c130977367bfee8c854811ee96381a6cbc54ac4d
-
SHA512
ab81533d0eac4ae885871f6d4991bdc97ce6ae2fb35cb26bde5e8a987338f32b5aee033a5fd437d9cc14fb4db3a0b9ebc4e6b31fd93497e33b2afadb126894f3
-
SSDEEP
6144:TgLxtJnhCM9GFgCiBoQXIEes8BN70i8DIHIhojbEOihmVl6i+YhBMsEYNrK:UoFgPBlXHeNNcDajHEORl6i+YsWZK
Static task
static1
Behavioral task
behavioral1
Sample
fb7847373477a5148f190949c130977367bfee8c854811ee96381a6cbc54ac4d.exe
Resource
win7-20220812-en
Malware Config
Extracted
cybergate
2.6
new504
Firefox.ignorelist.com:82
drd78sv8edrj
-
enable_keylogger
false
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
dwm.exe
-
install_dir
Mozilla
-
install_file
Flash_Update.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Notice: Undefined index: template in /opt/lampp/htdocs/install/index.php on line 17 Notice: Undefined index: language in /opt/lampp/htdocs/install/index.php on line 21 Notice: Use of undefined constant _logout_true - assumed '_logout_true' in /opt/lampp/htdocs/inc/_lang/english.php on line 17 Notice: Use of undefined constant _login_true - assumed '_login_true' in /opt/lampp/htdocs/inc/_lang/english.php on line 18 Notice: Use of undefined constant _login_false_pwd - assumed '_login_false_pwd' in /opt/lampp/htdocs/inc/_lang/english.php on line 19 Notice: Use of undefined constant _login_false_name - assumed '_login_false_name' in /opt/lampp/htdocs/inc/_lang/english.php on line 20 Notice: Use of undefined constant _login_not_active_map - assumed '_login_not_active_map' in /opt/lampp/htdocs/inc/_lang/english.php on line 21 Notice: Use of undefined constant _save_area - assumed '_save_area' in /opt/lampp/htdocs/inc/_lang/english.php on line 23
-
message_box_title
ERROR
-
password
1234abc
-
regkey_hkcu
Flash_Update
-
regkey_hklm
Java_Update
Targets
-
-
Target
fb7847373477a5148f190949c130977367bfee8c854811ee96381a6cbc54ac4d
-
Size
365KB
-
MD5
211f5b91e02cce9155adcbb0ad9233f0
-
SHA1
2a04655504ec02036e750aa8c3aff776df9b7b14
-
SHA256
fb7847373477a5148f190949c130977367bfee8c854811ee96381a6cbc54ac4d
-
SHA512
ab81533d0eac4ae885871f6d4991bdc97ce6ae2fb35cb26bde5e8a987338f32b5aee033a5fd437d9cc14fb4db3a0b9ebc4e6b31fd93497e33b2afadb126894f3
-
SSDEEP
6144:TgLxtJnhCM9GFgCiBoQXIEes8BN70i8DIHIhojbEOihmVl6i+YhBMsEYNrK:UoFgPBlXHeNNcDajHEORl6i+YsWZK
-
Adds policy Run key to start application
-
Executes dropped EXE
-
Modifies Installed Components in the registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-