General
-
Target
49f7bdf7a08846e72a676b379efeff5d
-
Size
324KB
-
Sample
240107-2nzkwaggd3
-
MD5
49f7bdf7a08846e72a676b379efeff5d
-
SHA1
f0c12aa9b06ff2a2a0f045bfc29e103a3c4e614d
-
SHA256
3cc092fbd13681f32f3eaaf74d1332650d143074022adf9cf7ffdd9b9b8cd349
-
SHA512
66cb8a8d4df9ff8f8385b1eee0bc964af71aaf99c72a0e86ddf7535486eaddad44e770fd3358a47781166a66dfea9ff515923aec78d0ac489a731d9dc5eb32df
-
SSDEEP
6144:SnY7Ypc/h1ppPxtNSvKbH0n5HszGYTFQmu1jc0qNVPVo13nHp1KP:QY7Yo1pprNSibK54pfuUNVM3n+P
Static task
static1
Behavioral task
behavioral1
Sample
49f7bdf7a08846e72a676b379efeff5d.exe
Resource
win7-20231215-en
Malware Config
Extracted
cybergate
v1.07.5
Slave
rattest.no-ip.info:1605
727TLJG5QWQ1X2
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
install
-
install_file
server.exe
-
install_flag
false
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
123456
Targets
-
-
Target
49f7bdf7a08846e72a676b379efeff5d
-
Size
324KB
-
MD5
49f7bdf7a08846e72a676b379efeff5d
-
SHA1
f0c12aa9b06ff2a2a0f045bfc29e103a3c4e614d
-
SHA256
3cc092fbd13681f32f3eaaf74d1332650d143074022adf9cf7ffdd9b9b8cd349
-
SHA512
66cb8a8d4df9ff8f8385b1eee0bc964af71aaf99c72a0e86ddf7535486eaddad44e770fd3358a47781166a66dfea9ff515923aec78d0ac489a731d9dc5eb32df
-
SSDEEP
6144:SnY7Ypc/h1ppPxtNSvKbH0n5HszGYTFQmu1jc0qNVPVo13nHp1KP:QY7Yo1pprNSibK54pfuUNVM3n+P
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-