Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
f1d1aff1630f101bd58c10e1104a7b85d2005a813d394e074f7f2bb632f9bf23
-
Size
284KB
-
Sample
221125-yjyagaeb2t
-
MD5
09b935d6cbba89efaaf140dd4eb59336
-
SHA1
b3609d7fb44e698b9c2d407a34bd98a903329c49
-
SHA256
f1d1aff1630f101bd58c10e1104a7b85d2005a813d394e074f7f2bb632f9bf23
-
SHA512
05e69236fcd28c3f267a32d21285fe6cc645bf97be4ecc254895e982af3aad21ddd2f8c146f20851e610592f050d60d1eb7b119d6241054984f22e59f61504d4
-
SSDEEP
6144:+k4qmxdvZr/KCbCZXw/MnTA/9u3k+0qS6HINLYAHL:h9wrrCCbZNVu3kvoA
Behavioral task
behavioral1
Sample
f1d1aff1630f101bd58c10e1104a7b85d2005a813d394e074f7f2bb632f9bf23.exe
Resource
win7-20220812-en
Malware Config
Extracted
cybergate
2.6
ÖÍíÉ
127.0.0.1:288
127.0.0.1:1177
***MUTEX***
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
svchost.exe
-
install_file
windows.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
texto da mensagem
-
message_box_title
t?tulo da mensagem
-
password
123456
Targets
-
-
Target
f1d1aff1630f101bd58c10e1104a7b85d2005a813d394e074f7f2bb632f9bf23
-
Size
284KB
-
MD5
09b935d6cbba89efaaf140dd4eb59336
-
SHA1
b3609d7fb44e698b9c2d407a34bd98a903329c49
-
SHA256
f1d1aff1630f101bd58c10e1104a7b85d2005a813d394e074f7f2bb632f9bf23
-
SHA512
05e69236fcd28c3f267a32d21285fe6cc645bf97be4ecc254895e982af3aad21ddd2f8c146f20851e610592f050d60d1eb7b119d6241054984f22e59f61504d4
-
SSDEEP
6144:+k4qmxdvZr/KCbCZXw/MnTA/9u3k+0qS6HINLYAHL:h9wrrCCbZNVu3kvoA
-
Adds policy Run key to start application
-
Executes dropped EXE
-
Modifies Installed Components in the registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-