General
-
Target
cc7d90f9bec947bc93a2ded1a009c4190ae4ad44a81b1916a9ef3c9f2bdb68e7
-
Size
474KB
-
Sample
221124-ntx3cabd82
-
MD5
9e001cab4aac82481dd932fdec2a5405
-
SHA1
1a1d9b1680b3cb1adc3c5ddf0e4a459d5e5f094c
-
SHA256
cc7d90f9bec947bc93a2ded1a009c4190ae4ad44a81b1916a9ef3c9f2bdb68e7
-
SHA512
5d8f88077be2598dbeca3b44238346cc3acdcb76dfd06d1851ec28c289e7d7147bf355f937f9c1be56a84e895690e9c5762ac68e9ef9535c1c3774aa5c734344
-
SSDEEP
6144:3xJsGLn2FlFfFlFfFlFQ0oxDNT/xQphU+jrlgzfuzt91C9NDyWId98HhqbxtHGZV:hJsGaFnFnFo04h/xQp6+tqOYy9zo0c
Behavioral task
behavioral1
Sample
cc7d90f9bec947bc93a2ded1a009c4190ae4ad44a81b1916a9ef3c9f2bdb68e7.exe
Resource
win7-20220812-en
Malware Config
Extracted
cybergate
v1.02.1
PB
hackermanias.no-ip.org:81
hackermanias.no-ip.org:82
hackermanias.no-ip.org:83
Pluguin
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
Windows
-
install_file
svchost.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
VOCÊ FOI HACKEADO ...SEU SISTEMA SERÁ FORMATADO.
-
message_box_title
LAMMER
-
password
andre123
-
regkey_hkcu
java
-
regkey_hklm
java
Targets
-
-
Target
cc7d90f9bec947bc93a2ded1a009c4190ae4ad44a81b1916a9ef3c9f2bdb68e7
-
Size
474KB
-
MD5
9e001cab4aac82481dd932fdec2a5405
-
SHA1
1a1d9b1680b3cb1adc3c5ddf0e4a459d5e5f094c
-
SHA256
cc7d90f9bec947bc93a2ded1a009c4190ae4ad44a81b1916a9ef3c9f2bdb68e7
-
SHA512
5d8f88077be2598dbeca3b44238346cc3acdcb76dfd06d1851ec28c289e7d7147bf355f937f9c1be56a84e895690e9c5762ac68e9ef9535c1c3774aa5c734344
-
SSDEEP
6144:3xJsGLn2FlFfFlFfFlFQ0oxDNT/xQphU+jrlgzfuzt91C9NDyWId98HhqbxtHGZV:hJsGaFnFnFo04h/xQp6+tqOYy9zo0c
-
Executes dropped EXE
-
Modifies Installed Components in the registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory
-