General
-
Target
825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c
-
Size
454KB
-
Sample
221201-lhfmtaab2x
-
MD5
5b747bea00230414e196afd29ffd9cf7
-
SHA1
a1bff5c84bdb5895f693e7239735f93c81629c77
-
SHA256
825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c
-
SHA512
18e004758d760a26641186dfd4ac8d140a131f59d77f29e02c0b9e120d64e1cca80e8d1f5675a92f44031fd6fc78de9648d9da14da8fd158fe15314ea8ba0bfa
-
SSDEEP
6144:FEYZenDUvNOYa+qmbjqsPGp3OJbsGynZO3ehp6k7+4Kgkw2D+QBOBw1VIfQFS2wx:Xen4vMJMqmeHZEepuw2apORD8
Static task
static1
Behavioral task
behavioral1
Sample
825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c.exe
Resource
win7-20220812-en
Malware Config
Extracted
cybergate
v1.18.0 - Crack Version
q
looost.no-ip.biz:90
K0672GC34DW2QD
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
explorer
-
install_file
explorer.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
123
Targets
-
-
Target
825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c
-
Size
454KB
-
MD5
5b747bea00230414e196afd29ffd9cf7
-
SHA1
a1bff5c84bdb5895f693e7239735f93c81629c77
-
SHA256
825f7b53d5ff21207e0d650a6e1d18c34f9a87f9839bd33ec4635ec312e9743c
-
SHA512
18e004758d760a26641186dfd4ac8d140a131f59d77f29e02c0b9e120d64e1cca80e8d1f5675a92f44031fd6fc78de9648d9da14da8fd158fe15314ea8ba0bfa
-
SSDEEP
6144:FEYZenDUvNOYa+qmbjqsPGp3OJbsGynZO3ehp6k7+4Kgkw2D+QBOBw1VIfQFS2wx:Xen4vMJMqmeHZEepuw2apORD8
-
Molebox Virtualization software
Detects file using Molebox Virtualization software.
-
Adds policy Run key to start application
-
Modifies Installed Components in the registry
-