General
-
Target
7ae9e9ab2a30647b07b5ccbeb1a7d7f1e68041a18fc6c821a740f6ad5fabdbf0
-
Size
369KB
-
Sample
221124-p21nwaec29
-
MD5
a3fc3af168ce3acfad35a459f49c4174
-
SHA1
92fbbbe27735b5862ebb2a7eb979be1e3c90c216
-
SHA256
7ae9e9ab2a30647b07b5ccbeb1a7d7f1e68041a18fc6c821a740f6ad5fabdbf0
-
SHA512
6df2746bc08931e08bee8395c9af6871e58ae551f55b2e8c55a31a7e3c3a7211ae745c56f6b1bac1d5f4aaa6cf43901ca2b4f89a299f5ae3a0ff284236e30f5c
-
SSDEEP
6144:bC30iEhXsKZ4BkWXCw3tumaNiaG0CvsU1am5LHngHf3sQ67evKpxwhPjySM/heK:W30xp4O6CCSiaEZAIngHf3s77eixuPjc
Static task
static1
Behavioral task
behavioral1
Sample
cc-checker-for-windows.exe
Resource
win7-20221111-en
Malware Config
Extracted
cybergate
v3.4.2.2
BITCOIN
bitcoin2014.no-ip.org:88
WHBOPW0F2QU138
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
Win32
-
install_file
algr.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
peces
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Targets
-
-
Target
cc-checker-for-windows.exe
-
Size
1.2MB
-
MD5
917f017943acb84f9d09e328b9925ca2
-
SHA1
32fc6917fea4947d554105c848bb84378d60df0e
-
SHA256
cc2c4ea5a1d63d5d54f57b82cfaf7473a2b9e8a30a00490089d3133130b75df1
-
SHA512
3e758ef222c21b688efded0446cc6098c219823b6121bd0f16ee3aa41a218fc639e5f495c6abf34b6b5d215a3262564abc34801d716bc69ac7a74e7a2a867286
-
SSDEEP
6144:0LJJK2Ay5zdBV45NX1woIuDYDpdVbR4n6I:0v9v
-
Adds policy Run key to start application
-
Executes dropped EXE
-
Modifies Installed Components in the registry
-
Drops startup file
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-