General
-
Target
0x00080000000120ff-2.dat
-
Size
282KB
-
Sample
231201-bvkgesdd77
-
MD5
88f4c6b1a74cfab65a524eba5fb51890
-
SHA1
8ebecbe8f09d286da80db0397f2f01cf1ce00dc0
-
SHA256
9ac17e49e69dbdbe33525dfcecc73b7edbe64c3de554253146c77c80df64b9c6
-
SHA512
4fc6ec50f0f999b95cf7d9035ab1ba430fa610d89c073750097bc498c22ee681a18869e31f2c840019f030c507f3a170bcba276299be3339805f795417ff2dc2
-
SSDEEP
6144:FxJsGLnGZoxDNT/xQphU+jrlgzfuzt91C9NDyWId98HhqbxtHGZ9:XJsGaZ4h/xQp6+tqOYy9zo0S
Behavioral task
behavioral1
Sample
0x00080000000120ff-2.exe
Resource
win7-20231020-en
Malware Config
Extracted
cybergate
v1.02.1
Lammer
thzinhacker.ddns.net:1177
Pluguin
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./
-
ftp_interval
30
-
injected_process
svchost.exe
-
install_dir
Microsoft
-
install_file
Pluguin.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
VOCÊ FOI HACKEADO ...SEU SISTEMA SERÁ FORMATADO.
-
message_box_title
LAMMER
-
password
123
-
regkey_hkcu
Avirnt
-
regkey_hklm
Avgnt
Targets
-
-
Target
0x00080000000120ff-2.dat
-
Size
282KB
-
MD5
88f4c6b1a74cfab65a524eba5fb51890
-
SHA1
8ebecbe8f09d286da80db0397f2f01cf1ce00dc0
-
SHA256
9ac17e49e69dbdbe33525dfcecc73b7edbe64c3de554253146c77c80df64b9c6
-
SHA512
4fc6ec50f0f999b95cf7d9035ab1ba430fa610d89c073750097bc498c22ee681a18869e31f2c840019f030c507f3a170bcba276299be3339805f795417ff2dc2
-
SSDEEP
6144:FxJsGLnGZoxDNT/xQphU+jrlgzfuzt91C9NDyWId98HhqbxtHGZ9:XJsGaZ4h/xQp6+tqOYy9zo0S
-
Adds policy Run key to start application
-
Modifies Installed Components in the registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-