Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36
-
Size
637KB
-
Sample
221107-ype13sfbf8
-
MD5
0b16cabd2d4409e7fe84175dc5ab815a
-
SHA1
9bf32be127ab5c6a8c49435be5c6e17e984d01ef
-
SHA256
09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36
-
SHA512
9d6f1d926c237fb2bb30de68b7a6c5e0352d53d9511d167b4911bf50f24b95dfebadb6f9432f4592a23debe83aa2c892a58590c5d8cd95f34939d0354be0cb02
-
SSDEEP
12288:6E4OUI9+3x/RqF/+IvciVbKJoTGB8aVUOKc77q15E3e:6EaI9+3xMFmQlVb6iaVUOKc3mJ
Static task
static1
Behavioral task
behavioral1
Sample
09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36.exe
Resource
win7-20220812-en
Malware Config
Extracted
cybergate
2.6
ÖÍíÉ
kyfen.no-ip.biz:288
***MUTEX***
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
svchost.exe
-
install_file
windows.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
texto da mensagem
-
message_box_title
título da mensagem
-
password
abcd1234
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Targets
-
-
Target
09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36
-
Size
637KB
-
MD5
0b16cabd2d4409e7fe84175dc5ab815a
-
SHA1
9bf32be127ab5c6a8c49435be5c6e17e984d01ef
-
SHA256
09383433a352ff33d3b2f1ca6602f429e10dab17896e0ae1f2475e95d07a7c36
-
SHA512
9d6f1d926c237fb2bb30de68b7a6c5e0352d53d9511d167b4911bf50f24b95dfebadb6f9432f4592a23debe83aa2c892a58590c5d8cd95f34939d0354be0cb02
-
SSDEEP
12288:6E4OUI9+3x/RqF/+IvciVbKJoTGB8aVUOKc77q15E3e:6EaI9+3xMFmQlVb6iaVUOKc3mJ
-
Adds policy Run key to start application
-
Executes dropped EXE
-
Modifies Installed Components in the registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-