General
-
Target
f3e5b41d4dc59e987a5546d8a7dcfd5c5a50745f9e02480b024eb88ec882d8ae
-
Size
365KB
-
Sample
221127-rychzshg8v
-
MD5
6876d094fe2676860658696daee772b4
-
SHA1
1eb278002ac7dddca4a92305a601d35c4dc91518
-
SHA256
f3e5b41d4dc59e987a5546d8a7dcfd5c5a50745f9e02480b024eb88ec882d8ae
-
SHA512
2e916008199b26aa8ec9d65e7491392d940db6697c032b41627d634af0f8bcd115a982f0a6410293f64a48092160524f79b066a87bcf93204b1d99f4d6c2087f
-
SSDEEP
6144:TgLxtJnhCM9GFgCiBoQXIEes8BN70i8DIHIhojbEOihmVl6i+YhBMsEYNrA:UoFgPBlXHeNNcDajHEORl6i+YsWZA
Static task
static1
Behavioral task
behavioral1
Sample
f3e5b41d4dc59e987a5546d8a7dcfd5c5a50745f9e02480b024eb88ec882d8ae.exe
Resource
win7-20220901-en
Malware Config
Extracted
cybergate
2.6
new504
Firefox.ignorelist.com:82
drd78sv8edrj
-
enable_keylogger
false
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
dwm.exe
-
install_dir
Mozilla
-
install_file
Flash_Update.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Notice: Undefined index: template in /opt/lampp/htdocs/install/index.php on line 17 Notice: Undefined index: language in /opt/lampp/htdocs/install/index.php on line 21 Notice: Use of undefined constant _logout_true - assumed '_logout_true' in /opt/lampp/htdocs/inc/_lang/english.php on line 17 Notice: Use of undefined constant _login_true - assumed '_login_true' in /opt/lampp/htdocs/inc/_lang/english.php on line 18 Notice: Use of undefined constant _login_false_pwd - assumed '_login_false_pwd' in /opt/lampp/htdocs/inc/_lang/english.php on line 19 Notice: Use of undefined constant _login_false_name - assumed '_login_false_name' in /opt/lampp/htdocs/inc/_lang/english.php on line 20 Notice: Use of undefined constant _login_not_active_map - assumed '_login_not_active_map' in /opt/lampp/htdocs/inc/_lang/english.php on line 21 Notice: Use of undefined constant _save_area - assumed '_save_area' in /opt/lampp/htdocs/inc/_lang/english.php on line 23
-
message_box_title
ERROR
-
password
1234abc
-
regkey_hkcu
Flash_Update
-
regkey_hklm
Java_Update
Targets
-
-
Target
f3e5b41d4dc59e987a5546d8a7dcfd5c5a50745f9e02480b024eb88ec882d8ae
-
Size
365KB
-
MD5
6876d094fe2676860658696daee772b4
-
SHA1
1eb278002ac7dddca4a92305a601d35c4dc91518
-
SHA256
f3e5b41d4dc59e987a5546d8a7dcfd5c5a50745f9e02480b024eb88ec882d8ae
-
SHA512
2e916008199b26aa8ec9d65e7491392d940db6697c032b41627d634af0f8bcd115a982f0a6410293f64a48092160524f79b066a87bcf93204b1d99f4d6c2087f
-
SSDEEP
6144:TgLxtJnhCM9GFgCiBoQXIEes8BN70i8DIHIhojbEOihmVl6i+YhBMsEYNrA:UoFgPBlXHeNNcDajHEORl6i+YsWZA
-
Adds policy Run key to start application
-
Executes dropped EXE
-
Modifies Installed Components in the registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-