General
-
Target
8f2f4a447404dac29dd1c6305c32b0f1ea8646bd395d9ba554bf24524abb0e95
-
Size
587KB
-
Sample
230129-26wxpsgg82
-
MD5
5c7310b5379214dc6f87f6a81a69d569
-
SHA1
6bf707b4117c9bdef6dbf86bbcee77f05c855869
-
SHA256
8f2f4a447404dac29dd1c6305c32b0f1ea8646bd395d9ba554bf24524abb0e95
-
SHA512
b3386caba3959c7f6a0bb362a11e261252ba98ed5ac601f1fe7991f28af60d668d48feb4b99bfab0bfdb53bbadf69a4984fc70f4133d5c8aedcb0e05515584c7
-
SSDEEP
12288:0RIM7C5ZF2zW86Ng8EniFIWJpoJ5sNCmkQnlFet9RP0dSQ3A:0RV4brNZlEWS
Static task
static1
Behavioral task
behavioral1
Sample
8f2f4a447404dac29dd1c6305c32b0f1ea8646bd395d9ba554bf24524abb0e95.exe
Resource
win7-20221111-en
Malware Config
Extracted
cybergate
v1.07.5
remote
securenetworks.no-ip.org:8088
F0003B74F12VI4
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
install
-
install_file
server.exe
-
install_flag
false
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
cybergate
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Targets
-
-
Target
8f2f4a447404dac29dd1c6305c32b0f1ea8646bd395d9ba554bf24524abb0e95
-
Size
587KB
-
MD5
5c7310b5379214dc6f87f6a81a69d569
-
SHA1
6bf707b4117c9bdef6dbf86bbcee77f05c855869
-
SHA256
8f2f4a447404dac29dd1c6305c32b0f1ea8646bd395d9ba554bf24524abb0e95
-
SHA512
b3386caba3959c7f6a0bb362a11e261252ba98ed5ac601f1fe7991f28af60d668d48feb4b99bfab0bfdb53bbadf69a4984fc70f4133d5c8aedcb0e05515584c7
-
SSDEEP
12288:0RIM7C5ZF2zW86Ng8EniFIWJpoJ5sNCmkQnlFet9RP0dSQ3A:0RV4brNZlEWS
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-