General
-
Target
d6b540e55669e929e21cbe976f1a850198df009483d2fe64b6bc73636a7a851b
-
Size
406KB
-
Sample
221123-1vv1labd4s
-
MD5
44061cf45318984fe9cc37dd0fb0ad41
-
SHA1
2e5cb561542d18b1f02933a59fe307e119242fe0
-
SHA256
d6b540e55669e929e21cbe976f1a850198df009483d2fe64b6bc73636a7a851b
-
SHA512
181087058e58f437d82e8e69929af7fa63ab91a1d30e717633375b13c59e9014e5a31c7d5b20cebcdfa6da25004c2dd834cbd9ccd816cc7550469265705a71d5
-
SSDEEP
12288:CEdn0YCMObGs5VH2tkTQo2Y/vzu5LWugobcm:NF0Yqj12it2Y/vS5fgEcm
Static task
static1
Behavioral task
behavioral1
Sample
d6b540e55669e929e21cbe976f1a850198df009483d2fe64b6bc73636a7a851b.exe
Resource
win7-20221111-en
Malware Config
Extracted
cybergate
2.6
Victima
socorsovolpe.no-ip.biz:81
***xMUTEx***
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
Uninstall
-
install_file
system32.dlll
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
texto da mensagem
-
message_box_title
tÃtulo da mensagem
-
password
123456789
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Targets
-
-
Target
d6b540e55669e929e21cbe976f1a850198df009483d2fe64b6bc73636a7a851b
-
Size
406KB
-
MD5
44061cf45318984fe9cc37dd0fb0ad41
-
SHA1
2e5cb561542d18b1f02933a59fe307e119242fe0
-
SHA256
d6b540e55669e929e21cbe976f1a850198df009483d2fe64b6bc73636a7a851b
-
SHA512
181087058e58f437d82e8e69929af7fa63ab91a1d30e717633375b13c59e9014e5a31c7d5b20cebcdfa6da25004c2dd834cbd9ccd816cc7550469265705a71d5
-
SSDEEP
12288:CEdn0YCMObGs5VH2tkTQo2Y/vzu5LWugobcm:NF0Yqj12it2Y/vS5fgEcm
-
Adds policy Run key to start application
-
Modifies Installed Components in the registry
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-