Analysis

  • max time kernel
    149s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/01/2024, 02:52

General

  • Target
    6e87aaaecb0f74cd2ad6ef6fe86ed4c2.exe
  • Size 344KB
  • Sample240122-dc9ppsegej
  • SHA256 16b23dad5c6d23545a57fceff139ebed529a6676c2f186f9b0c7fbff2c5c524e
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • debili39.no-ip.biz:6340

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    spynet

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 12 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3436
      • C:\Users\Admin\AppData\Local\Temp\6e87aaaecb0f74cd2ad6ef6fe86ed4c2.exe
        "C:\Users\Admin\AppData\Local\Temp\6e87aaaecb0f74cd2ad6ef6fe86ed4c2.exe"
        2⤵
        • Adds policy Run key to start application
        • Modifies Installed Components in the registry
        • Adds Run key to start application
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:4720
        • C:\Windows\SysWOW64\explorer.exe
          explorer.exe
          3⤵
          • Modifies Installed Components in the registry
          PID:2292
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe"
          3⤵
            PID:2964
          • C:\Users\Admin\AppData\Local\Temp\6e87aaaecb0f74cd2ad6ef6fe86ed4c2.exe
            "C:\Users\Admin\AppData\Local\Temp\6e87aaaecb0f74cd2ad6ef6fe86ed4c2.exe"
            3⤵
            • Checks computer location settings
            • Drops file in System32 directory
            • Modifies registry class
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:2792
            • C:\Windows\SysWOW64\spynet\server.exe
              "C:\Windows\system32\spynet\server.exe"
              4⤵
              • Executes dropped EXE
              PID:4376
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4376 -s 576
                5⤵
                • Program crash
                PID:228
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4376 -ip 4376
        1⤵
          PID:3364

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              UuU.uUu

              • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
              • Size 8B
              • SHA256 6231e9093c559ff8b8ab8e99d282e950b78847fa18b3b1a561c0aa9b4b1e6ec1
              • MD5 SHA1 SHA512

              XX--XX--XX.txt

              • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
              • Size 229KB
              • SHA256 a7c0228475019b38967ec9e1292a15182471cb41c378c188ad5556d2b4118d9c
              • MD5 SHA1 SHA512 SSDEEP

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 91a50e2e596a1901c9164224a3a0a98806b9d70f18cdf3c3302177683c4f2810
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4717a2137d5154aa82d3b15c1453b24bdffc9730ed8ad68de7b791fd55a52848
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e03e9e87c747b8bf6e50bef0bcc44ec0fe5b24ca6933b611c8a4351393bb915c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1710b07f83b41c234f0b02be7eac585e9921e43a2e2c3c59125e129f3cd2c96f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 55b1ef95c51aad236985d9ba7a42376cd96fab5559646641d20eda31f38d406e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8803685e273c7f565a407d302632ac2c76917418d44338ce23bda985941e6c8c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2e19ada452ee23276bbbbd1dcc1dcbefe04c8be4319a7109dfe65b88f4363f2d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f8e2b77e8bcb63d6ff414535311b67295052eddafc80fefbf92a1bf5af191dfb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5011939e91da84109c4507e8f17441817384eb10679f8d49cd191762bdb93e1a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3c8516c66cb86e9606ecd7beab3ba6ae0f9965dedc237b8be900bcbf7a5ffe60
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4251dd130a77ac58649e9298a618d3b8483a18419aed2e2c69c5f54ad2b1ae5e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e45b980624da0b1fba6f62b1ae1281f967e90e32758e21cf0aeeb8e152c25636
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d88632cd17a02f4f023d5cbdad67023ad738b77ced5c2848c6d66e411d3dd0b8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ecaa42af2c9940786c35abb7705d227a2e0135366feaefa4e55397bf224ea7a1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 931bfdf9633b8a2104d1118e8c48f6412c9ea420c32d4cc20809b2ecf6373b01
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 537dc37dce9d4e642412190d68abdc2352c5328c313877f4eca6ed6620aa6f08
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 eb3af4401dfdf57bf351041461b6d5c9f6f3adffccc2ab85e253355178545e28
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1fb3905782ce975465b636684ecd5bb945cdc5ed8e2360b7b43a7729e3e4ba2d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d76dfe5f83e920d46893fe0d11b8ca2c90daa0150d87a9935abecc46511d6bc1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 aa89d990544ae90152462688caa83f15933b802b1300af9eb92c076ebdfaf77b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b117b3441744cca1524ccc3929ad99e53c12821721ad969327cfa6aee19bb3d1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c6cb593f151bd29d349360e4ac78ac0d060a1f9863b93c1a961cac37edf1eb5b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 150712a84d486938f28de406d83148be946c736c3e0b5e60b53076d954d59814
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2b5fcdf8ed3588565a227864b6bb168aa355962f7be305803f41367784837752
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7c771b0b24b5ed28357bda3ed913040e29412d4dd46c0ec4b20059ecc7d7f113
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 98291a06474fd3247c2f9dbb613bcac239926535dcdbd07b6cbddd1890f2f67a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0dc3e721f4d84871a7a3bee5e50105f723f74dde6c053686303958a4048f4356
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d594bb932e335393d72e4d38cef0faa28da131d58afc81928d973522e721eb17
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c0d6d8b265a0426ede3ee4e254ecbc0253218b020b5bae46d225763714ad0065
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 93d5c0ee42b51d2e85b9bbf42fca749761daf547700e384e1c56d82e314c7b87
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 df1c0c9755a9d51ed1a872e16a3183dabadc892b8e40f31434bd90f7cb4625f9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4b169404f62cb13e764d128abd6a5110bc17c3e94c490a23c3795f98922bc6ab
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a7f2e16238bd687592e9f2c292ccb3d47b4b5362bf3ce6f8590935cc475a0fd9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7a28f02af4fb25f290154da203b598020de8d97a6fb2fc874bbd0a0801216c9a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5e2a9f7588955485c59bb71248808173df34a8aea5787c6718bc2e1c0e97f424
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2407027d99c0ad8eeaf81578514a4a3599fea371b794bd4d4825801f9d00a0a8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d8afb8c7168af665ee20db10497594fad5fc9ccf77888655dfb34fc7dfae7e48
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 57cc801cc49e8f90fb256c08a7d309fa65fbc74a87d68b4f5f95dd3d7f71292e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9c9c1d76c9252c0ffe1d1b0f8475ab009a8c4b1ea321443733ce45bb17adf455
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9ba9a9b26e48d3d512b17c8774151f36603ad700ce3219959f34731338f9d11e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8b172aea5784ffaadaa9cc8655a209e0deda6cb63966601a1027a5fafe0fe44b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 29e8aace94ed0bc35c020271828a1d6938577a9274b2594e317f017e566a9bfa
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dd101c765212ca3b59c0271cc9c5956286752be2bd600ce79307e2426a9e1a2f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dceef83e8a65ddd8d6fc8a58320f90821acc01a64a4854e830b7acc9eeba0d25
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8d7dc8b5255e8841102c47e4a7822c5d1b634387b98c54cbf101e808f1a81757
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 15cdc7bbd24e1886e001b4438c32d9031f8288ebb6f6294c2e5d9846223accff
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3140eca0ad16f0d80dcbd5be76a03950567c570e211dce9a95d6dada9d93b824
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1e6815baba91a8bd30527a98900dac07b42d2fdcc240fe6d1634ed56eeea9b0d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 49480564bd2f89705c5c927618c84676de6a988dcfcb8b28e4e9bbce2fe4df11
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9feefebd7b40d64bdc199583b8245abbbc10e1b2047a4e600059e57aa2ea6cdc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4a190aa0ab0b8847871b77d4724c5e8d03624bf843ce3c9a3000a71a350b3278
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 31652d4fae44e98145e36dc05734786121ed614f4b6b7a0b56f716159118c225
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b5baaf2a83d1ce88cc26405af5e48151b4330ea2510120cf07545a068a6156f5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 42d3ca290c95f6b192a7e5be0832ce0c74a2a52cfc74fea852bc64336774a32c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6b343e58168c0c2240877becc8bcbd8eb30c6140aab6d1096b2afc90b6c189d3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f5c778e0d53f67c7d5f199548a41d2e138deb2f2718b0d1e53bcb5e406be33ff
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a7b7d9619c60677473e017f4d1dc06aa4493811c7cefd9ca2f16014f6b417687
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 73287f1e3a6b6bab6aaf444150ec2ff7c5cfeea4705b39c33981bf93d96f4c64
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 97ef4479de5ea87f774e1c7730c7aff2f89c7e2ab35121959730345d487dceaa
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 59d89357812be971f4290258b82d834bb832781a7ac1f59feb13a325d75d367b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b4cc374767a04b17f98d585f53d0735743d2441faf8b7e4f7009f9a539461361
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ac93312cf2758aace8e1b026c91f06a621eac712297103a184277ecc573e0f1d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8a7e7408958245868a362c784d8cfa8f6d6595f321ed0c1a98b2aac2121c6a9e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 52193d3ca458b9c8bd6119fa7e9798e2d43977cf090a41a5d78f63ecb4d3d2e6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 981212030d88c5c0ebf411455e7cb313f2e50656e3a1b8c115303b1daec98ebf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1e7563dfd8d94a47660fe75c67b7cd0150d91ff689b4d35fa172a8ecc03fccfb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d8ce60f826e32f1ddafa9977bb3873f2e08f2c08c2f8b71c1bdbf14f4af1ccc9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 044eebae610e3c14965ddc9e8d7bc06cfda801cdcdab1d756c93a78282a378b0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a1b52406182c97b0bca78af62da83250fc67d13bd8711d2b3a8ed449ef8c9d53
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9e6f4fc91b8e1d575de49fd282d07da6cb7de039d6a4618e9a821b16065fa602
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 faa62e9e0af79b351c441cd21bfa713c18ed652d9a16f03dcd04f0aba24fd7ea
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1a625f692eaf0388c3a2d7bb035419b8463cb0c2272f537f37b06197fc5fcbd8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 86678d12a142f74256463ab00e4f6cdf203af0555eb3ce15468484aee2a46ceb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a9d2414f066e971fc668f29b11cf1d3ca21f3cbfbecc40fe80cacf6dc46dc455
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 77977cc2a5bbd5c114a11e96f4afb352906b02212e7d7b93f16c424b5de43f4c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0c8dbffb9b097ee5972698f5586f3df04cf8c4c2bdb60de297607ba4b847dc16
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a440797b26071c159dc30ab4f4ad338f5d858e26e9d4a42564d80dcf995c57d0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a3ba0630b2c0bf3dd956722bc5e1a00b4fb50815c830814096c32638e2452a9f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 17632c316ae818bb881b512a8128c79adb928d37c255119cde89d17e5bec66f2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2d82237bf6775cd799cee291caf557e05bf8657e77ff15ab269c63f70d055911
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d1edb59f388d1df26b194a6bc25252b994b15f42c90c689443b67b7b241a2941
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 333cf46ce6b3f3c9058439f15666f12c23648a9cace8dc921532a48cde608267
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d9198fc034d743cf4768a82d840f7f47364ae29828a003161cf7506621d770ca
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ff5bee6ac786399962c4d958c1ab32258d77138410a0ef5295a967bffc39a027
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 38c8cd40c71e078688caf78d9c85f579736ae0a81bcd1d0618d752ad28e04826
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2d564d6c09c88b637f5c997c1b547967ae6cb2382daa53b0501555a0398d1746
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 53e386a345d8e828691c6472fdcbef472960870461ca50728d64b9ce12cb1a90
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e4b96af032ae8076b62ba4e08fef041c06787ea4caf85ecd58963695daecdaea
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0b79b232ca5f8aeda937603505e417bbb2d87d1937d3e4f3fd5a45bb1a2613e9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 59c893d59ecc9324ef2647e79a2160fef5d7188df0be56e2d8d9aa2db627b58b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c79841859f69e34d8562eb7334a2708e53f0aca8ac7ef0817523d7b1941cca52
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f8e546dc173d5b742544d2bd3d6079a40ff44f65f76b78adc94dcb9cae5a9609
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c9558e71b908f51fdb6a1e7df8513d519ae5fd2b2fe05e0de19838151b457c59
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8508eb6506ef2f0352208ca8318951c40e41151b990f7fc4d184b43875d5deca
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dff1f9525cd0cda8512385c24d1603deab5dffa8fbd384a99974b4e30e5d07c5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5555b743a6e86aabd0e1087c0d0e2dbe04fd2f89d67f125fc3ea77d9e3673984
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 79f417bde3feda6e71bba83880f5b74c90e821b73a36a262548935d9264b75b5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4be2525f231284cd72786e5dd225d3e608b257f36a69dc30b427a6b2b6939cd9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4c6e6bf764d21ca97eaac043c6feb79f3cee25fad4d295b358e623952d495549
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7133461304d5fb6e72e697d4247b507a2fcb25a7358986b888285b6d457d8f18
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 703fd709b0cc1fb50e0a0e7f35037e35d7a8966f7a76c0ad0d632aa4abb5c7cc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7d9e73210301f3ad3e0b73e346f268229ab9c7b1fcdaf1badb3856fc1ee5fdb7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3ea8c975ec7672d9df8568040f298ab29b56cad664b7d8bb0162feac18be54fa
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 07751107c7bcce29c4bf629e857e01d81f4c8f56384154ea8b4911e126e88457
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 85d6e0f76bc97acd6312b413e27cbc9e27c9826e0a93b3d2f388a79f9e12ec35
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 66e563d4de7714785471b0058853dd19875286e51c4c277eac1f9d4208e80e06
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 aead7390a02ef481d383ddd706b6d73569186618064f826c7737197891b20cd5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 44615e847f7406398856254cb907f671e47aaa492ce9b0d79ced8342a1a339d5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3330e52156a55d041b82ffbbc41b22adca12d4e94a50c1ce12d7c68be11ede14
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d38ca8330fc6e0be3c9690236c7ee603b12e2cab2d401e1fcbf8871e6d3c5730
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b3ea5864fdc708385b98461ef224e9bea6179391fd303f12bc0af98eef2f6d7d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 eb72b79fe2ecc1824b74052a868c5e164befd9db4f748741710575681a4f0c8f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 68db9d53b94ca963f85bae56168eea07d610d963fcfbb00e6839ee967d9f169e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3653f78b75b291efa0bc96264e42a0b900348ba1d97a45460a48520a4750814d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 220f3daa686ea68abf37296b714e3df8881ffd2dd02025ddbfdebb37dbb9a493
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 568821c9edc2cfb8b6f7a400ea75b3a0029b3c98c923308ff1e4b108655c3072
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 49a14ec34ec763a9ffdf44c4c92e85b928198b71b17baef1927f884f44b38884
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f1a9b297801658a36789329097e6c485420538af7da5db3328a695eda92138ad
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9b767fd0fe9bff486314242a78dc3ed008f74c33f7a6167970135e049ad744f1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d3803d51f0e5b879655831300e9970375b0091767bb5e93d2836b315245490ce
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7c9a471d37b709de2e15946719732269f2f6e0d09ffbb42ac109346885b9b3b6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 127dab8a59a00e48176fb429b0797540ca126039faf230329db56afbf3501528
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8cfb686d4fc2b5c39ac7ab94e18b438e11dd73ccf3eed217ecb031d982e7536d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5339ebd37e0e3886ce7b0f91ddd2420bacee305adc5db07694b666284b2f1530
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 012a14b484bd15134314bf6389ca61c8109147151a281d7a6b28a3e8e3729ebd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ee7955232ff34533d9bece4c053d03082c71fed23ca17cc6e029d0db9f4de46b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bccef0851e6cb2809a901113197156385f0f0a5b88e3ccefbfaca02191991035
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c70a536d0728a2d95a60ff20f431e6251a5d0f49f9c66d3728d69a074edde602
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8a95332059ff05d508a432f9ecdfcfbed75a9451a50022a8100ee3ea47a23c38
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4a4c08b748e8732e28eafcf56458ef576bf517057d37a75d44105e829aa5dfc9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 879d11b5db7b33bb76bca1f126b181a33e89b0f5298d49175b23c8ad52320b8f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5d342bb6ddf6cc92057afd842c4bc0f04509592251daf593bc48a4eef73aec01
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1b532bb915c5e8df880e0b5837f8625552f382c44350ec5b9f3af77d4e3b5ef5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7896132003bf7685924e7222a039ab0d81218b8900083f67372dbcc1102dde0b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 66c8bcad5feea5c9d64a3ba52e6ae0124fce666d8ce4181482792b9a0ed6acd6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 925a4ffb8552fe0c5f20ee81f2daf0fa458d97a510f6d9069e3b668c7ebd9761
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ffa5a42a2ccfbc27bcdbc15722ed8d2f4a62868837e9ea5a39b5623d3de59ccd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 97692554e22bb6cfd70ee554ea5f7e24597e022f3af0d817c1c4bd4ae8e6b969
              • MD5 SHA1 SHA512

              logs.dat

              • Path C:\Users\Admin\AppData\Roaming\logs.dat
              • Size 15B
              • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
              • MD5 SHA1 SHA512

              server.exe

              • Path C:\Windows\SysWOW64\spynet\server.exe
              • Size 344KB
              • SHA256 16b23dad5c6d23545a57fceff139ebed529a6676c2f186f9b0c7fbff2c5c524e
              • MD5 SHA1 SHA512 SSDEEP

              memory/2292-67-0x0000000003EC0000-0x0000000003EC1000-memory.dmp

              memory/2292-9-0x00000000013D0000-0x00000000013D1000-memory.dmp

              memory/2292-8-0x0000000001310000-0x0000000001311000-memory.dmp

              memory/2292-69-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/2292-580-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/2292-68-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/2792-81-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/2792-1262-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/2792-139-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/4376-162-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/4720-140-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/4720-0-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/4720-4-0x0000000024010000-0x0000000024072000-memory.dmp

              memory/4720-64-0x0000000024080000-0x00000000240E2000-memory.dmp