General
-
Target
d580a63c97c6253668994eb0f9d1361d2cdfff6ba9924a836865d1d2fc748949
-
Size
267KB
-
Sample
221120-p29lsade29
-
MD5
3b45606e6ae265e95c4dc1adb971be06
-
SHA1
47b5a3ee01c247853663c4a5b6ed34382f792007
-
SHA256
d580a63c97c6253668994eb0f9d1361d2cdfff6ba9924a836865d1d2fc748949
-
SHA512
770178cd9a77a4dfda88fc03e569b03ae537f4726c0d7d5c42679e6fbcbcfe96384ce8b1ac9dcd33be254c78a66a60bf8fb7f09f2099966ae907680b4ed6e200
-
SSDEEP
6144:8i3VpJQjFXlL/5KOUV5njOzwqHabALuHmptYqdsN8rf4p:J+EB5njO5Hao3pU8rf
Behavioral task
behavioral1
Sample
d580a63c97c6253668994eb0f9d1361d2cdfff6ba9924a836865d1d2fc748949.exe
Resource
win7-20220812-en
Malware Config
Extracted
cybergate
v1.05.1
victime
jerem13.no-ip.biz:1024
2L081P0BN8BK8A
-
enable_keylogger
true
-
enable_message_box
true
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
install
-
install_file
server.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Le format de l'image n'est pas pris en charge
-
message_box_title
Erreur !
-
password
administrator
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Targets
-
-
Target
d580a63c97c6253668994eb0f9d1361d2cdfff6ba9924a836865d1d2fc748949
-
Size
267KB
-
MD5
3b45606e6ae265e95c4dc1adb971be06
-
SHA1
47b5a3ee01c247853663c4a5b6ed34382f792007
-
SHA256
d580a63c97c6253668994eb0f9d1361d2cdfff6ba9924a836865d1d2fc748949
-
SHA512
770178cd9a77a4dfda88fc03e569b03ae537f4726c0d7d5c42679e6fbcbcfe96384ce8b1ac9dcd33be254c78a66a60bf8fb7f09f2099966ae907680b4ed6e200
-
SSDEEP
6144:8i3VpJQjFXlL/5KOUV5njOzwqHabALuHmptYqdsN8rf4p:J+EB5njO5Hao3pU8rf
-
Adds policy Run key to start application
-
Executes dropped EXE
-
Modifies Installed Components in the registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-