General
-
Target
91c26835138ea6be11d9df5aa21a8f020584647621b6252f06a10b0ada7b598f
-
Size
457KB
-
Sample
221204-w5bbqahg8x
-
MD5
76c5a8145c450cc948ee193a3c3ba1c7
-
SHA1
07522978ac0c1d95d025937776fabb8386c95482
-
SHA256
91c26835138ea6be11d9df5aa21a8f020584647621b6252f06a10b0ada7b598f
-
SHA512
fc8bbc6f53987ad37e040961ee60dc8fe9d45aba9ed633f1c11565d832820adfe94d4db1f8d29236b41e478793b0b052f248dcbeaf6353d80fde376e69284a7d
-
SSDEEP
12288:Q1+bhNofZJtELfbEZlBPsxgaH8ZujeAVO9EHTdkx:KaNaLCT+l9sx98ZujewaEWx
Static task
static1
Behavioral task
behavioral1
Sample
91c26835138ea6be11d9df5aa21a8f020584647621b6252f06a10b0ada7b598f.exe
Resource
win7-20220812-en
Malware Config
Extracted
cybergate
2.7 Beta 02
victime
farfouch-hacker.no-ip.biz:81
***MUTEX***
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
install
-
install_file
server.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
texto da mensagem
-
message_box_title
tÃtulo da mensagem
-
password
abcd1234
Targets
-
-
Target
91c26835138ea6be11d9df5aa21a8f020584647621b6252f06a10b0ada7b598f
-
Size
457KB
-
MD5
76c5a8145c450cc948ee193a3c3ba1c7
-
SHA1
07522978ac0c1d95d025937776fabb8386c95482
-
SHA256
91c26835138ea6be11d9df5aa21a8f020584647621b6252f06a10b0ada7b598f
-
SHA512
fc8bbc6f53987ad37e040961ee60dc8fe9d45aba9ed633f1c11565d832820adfe94d4db1f8d29236b41e478793b0b052f248dcbeaf6353d80fde376e69284a7d
-
SSDEEP
12288:Q1+bhNofZJtELfbEZlBPsxgaH8ZujeAVO9EHTdkx:KaNaLCT+l9sx98ZujewaEWx
-
Adds policy Run key to start application
-
Executes dropped EXE
-
Modifies Installed Components in the registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-