General
-
Target
b272460741b873f8e5237dc42a0df832f9b1b22e19246be61d4f01c59e5f4899
-
Size
341KB
-
Sample
221203-se9j2sah73
-
MD5
f6963bf35872677c0951f80e1045d600
-
SHA1
6dea92224609c87bf40230343d0d3a3a3e2a838a
-
SHA256
b272460741b873f8e5237dc42a0df832f9b1b22e19246be61d4f01c59e5f4899
-
SHA512
52b2419a59c8ced6562a90d6f561452f7028e424a3b613abe8d1f7a29d6365fc701aef38ffdfcbb38aba339cf94b6aab4cea755a7abedee2c14c664c03d1d90b
-
SSDEEP
6144:0jWhODe3QFouyyvz4SSNpwQzRUZLQigaHRYkGYYxvOKUwygamiXY0354u:0C40Q+uys4SSNKKRKya8YYxmKazmeYyv
Static task
static1
Behavioral task
behavioral1
Sample
b272460741b873f8e5237dc42a0df832f9b1b22e19246be61d4f01c59e5f4899.exe
Resource
win7-20220812-en
Malware Config
Extracted
cybergate
v1.07.5
victime
pedologiciel.no-ip.org:81
A65C25I36501N8
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
windir
-
install_file
svchost.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Le bot Dofus n'est pas compatible avec votre Ordinateur actuel. Merci d'essayer de relancer le bot sur un nouvel ordinateur
-
message_box_title
INCOMPATIBLE
-
password
123456
-
regkey_hkcu
svchost.exe
-
regkey_hklm
svchost.exe
Targets
-
-
Target
b272460741b873f8e5237dc42a0df832f9b1b22e19246be61d4f01c59e5f4899
-
Size
341KB
-
MD5
f6963bf35872677c0951f80e1045d600
-
SHA1
6dea92224609c87bf40230343d0d3a3a3e2a838a
-
SHA256
b272460741b873f8e5237dc42a0df832f9b1b22e19246be61d4f01c59e5f4899
-
SHA512
52b2419a59c8ced6562a90d6f561452f7028e424a3b613abe8d1f7a29d6365fc701aef38ffdfcbb38aba339cf94b6aab4cea755a7abedee2c14c664c03d1d90b
-
SSDEEP
6144:0jWhODe3QFouyyvz4SSNpwQzRUZLQigaHRYkGYYxvOKUwygamiXY0354u:0C40Q+uys4SSNKKRKya8YYxmKazmeYyv
-
Executes dropped EXE
-
Modifies Installed Components in the registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-