General
-
Target
6685dadf189743e471cb8102b84806d9
-
Size
319KB
-
Sample
240119-bp7d1acghk
-
MD5
6685dadf189743e471cb8102b84806d9
-
SHA1
3b50eb5668387f102de26dc41a14e8eae723c687
-
SHA256
1c0970c1c5a0b7e9cc4df84f827eb552f45bcb3718ef59a01390212253364bd4
-
SHA512
36dd4c94ca622ea2413c49179cc49997e4e3b3291827da379c067fc36d0bbac44c5884270deee24e74cdbb9098423b173b9c1d22520973b0d671fc41700e73d8
-
SSDEEP
6144:RSpZ46Gp2lml9AGSOpDqWlx9fPLbFjW50nJ3iwjM87j49ndelPsFV0frVnz55d:R6Z49p2lEAGFRtLbF20nsafPOFepz5b
Static task
static1
Behavioral task
behavioral1
Sample
6685dadf189743e471cb8102b84806d9.exe
Resource
win7-20231215-en
Malware Config
Extracted
cybergate
v1.07.5
Cyber
sybreed.no-ip.biz:82
7AR723B2572JT7
-
enable_keylogger
false
-
enable_message_box
false
-
ftp_directory
./upload/
-
ftp_interval
60
-
ftp_password
qazwsx123
-
ftp_port
21
-
ftp_server
ftp.moneyunderground.co.cc
-
ftp_username
exoprism
-
injected_process
explorer.exe
-
install_dir
install
-
install_file
WinUpdate.exe
-
install_flag
false
-
keylogger_enable_ftp
true
-
message_box_caption
This program is not compatible with your Operating System.
-
message_box_title
Error
-
password
123456
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Targets
-
-
Target
6685dadf189743e471cb8102b84806d9
-
Size
319KB
-
MD5
6685dadf189743e471cb8102b84806d9
-
SHA1
3b50eb5668387f102de26dc41a14e8eae723c687
-
SHA256
1c0970c1c5a0b7e9cc4df84f827eb552f45bcb3718ef59a01390212253364bd4
-
SHA512
36dd4c94ca622ea2413c49179cc49997e4e3b3291827da379c067fc36d0bbac44c5884270deee24e74cdbb9098423b173b9c1d22520973b0d671fc41700e73d8
-
SSDEEP
6144:RSpZ46Gp2lml9AGSOpDqWlx9fPLbFjW50nJ3iwjM87j49ndelPsFV0frVnz55d:R6Z49p2lEAGFRtLbF20nsafPOFepz5b
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-