Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/01/2024, 03:36

General

  • Target
    764855ee853cf529539f87bd24693651.exe
  • Size 290KB
  • Sample240126-d596yaddd8
  • SHA256 4b50f5f1e8d8f35db928f5538e3a84ab3e12134e1d89333c0a781491e4e29a2d
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • 195.no-ip.biz:1338

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    SkYNet.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Erro Descupe Consute o Criador do Programa

  • message_box_title

    Erro Descupe Consute o Criador do Programa

  • password

    96848806

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\764855ee853cf529539f87bd24693651.exe
    "C:\Users\Admin\AppData\Local\Temp\764855ee853cf529539f87bd24693651.exe"
    1⤵
    • Adds policy Run key to start application
    • Modifies Installed Components in the registry
    • Adds Run key to start application
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:2848
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      2⤵
        PID:264
      • C:\Users\Admin\AppData\Local\Temp\764855ee853cf529539f87bd24693651.exe
        "C:\Users\Admin\AppData\Local\Temp\764855ee853cf529539f87bd24693651.exe"
        2⤵
        • Checks computer location settings
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        PID:2324
        • C:\Windows\SysWOW64\install\SkYNet.exe
          "C:\Windows\system32\install\SkYNet.exe"
          3⤵
          • Executes dropped EXE
          PID:3804
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3804 -s 572
            4⤵
            • Program crash
            PID:4920
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3804 -ip 3804
      1⤵
        PID:368

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 0a6b1f5e119f07f9be474b742697fab86f264fa57cc574dc415cda158f254978
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 229KB
            • SHA256 63855c93550121f5221c3b65c2b1a4ca37b0764d576656264127e9ee77a38e8e
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f22e1f64146524f0dd78897606a6df3d3a9e24105ae06f3808b220354bec4596
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 06dd27b243252d2c4e16d945fc5d83ceacb11a39e92026a67ae3ed27613d300e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 04f10bc62ecf4b8867eba612e6345b73e9b9d5855f3ce5f47dcd745dd5440efd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4b60537fcc7a7533d973a2bf5308bfe382d5c55af9886a349ad85d20aa8deae4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e29442beca89d680b11900ba4b13d4883f87051f8c450a6299f0d2fe20b4df40
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 33b4c733ff536443ce55e3affbee9db771c3e0906a8c421d022d620b2ad4e352
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d792bf690e7cd74dae274728c047865cfb88730fb342f992bd25bf725fdcc2b0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 751cd745b9d49f094871dc7fc2d917b33a4d33b3e068fbcfb65dd0994ccf047a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c6219c23762620a2c194bbc83bbac0e06d03cd4ab5071d658fa25a2c9a814ef6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 970440231978bad3bb404e86f970d5296b7a955706f65d05bde7748e6a61b513
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c7be9841fc67dced9ee0b90f1d02b8a210a65024f1b33e677535caabcf80aa6c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8f373cf00c2f8905f267e0e2554a50f13c837d3be4085e96d7d5d5ccffb9eab0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 56fe97994301d6a4a71a8f38fbaffd78d4c0147cdb292db1f7cec04318677b5c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6b8e2b814a8386c700b9143ca8223c22f6fe04ad08acdfa0e6433e30d665bfa8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f5cf430f65c35602a2c6b4f60432f1d330e9ea8cbda4168536c60931ad356aa9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eaa344d5c279130371a3f423b044b7ea8f5bf2f0ec6cd3cbe24cb709ca1df6e2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 afad013780e710936aec9e3aaab69f37c2bf7679f2d3a40e5a1626ccc670dd49
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d5e2f96360aa506ae1e4fb0b3a3a7176ea2c13e7f008610df8125625546adb03
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4ba6ff9f5e802c61cc5a6c0c447589f225fc5d4efe37555bb7fcbd94efb140f7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 24bb696216fced971cb85fc4fbf883f93b7fa480f8a0ef019d59a102c0ff3092
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d3bad8edebc2971ee8c2e5f3bb55d2c7a143ad5893bc6335a57aec3965315816
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 516a797041a64f01caab36660f57c237480b77f3baabbfe07b08ad5f50e8a4ec
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c14c4ccc6e194c560ba6b90850a59c84a26c2544263ccb5253be1b8de2ef5683
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 417dd969dae5089f552bce251b3fde1c04f829d3854f4cc5a38f3d9bc2512367
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f0641c781ed3e3eab2beb2fbfd87b309884b0f93929c1c356c8e59dfee0821a3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4cf90130cd0cf1862fbc78596d2ce04bd7f6cadcb818519c82a151c14c20bdfa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b6f05d3f9cdc22379218b02ac0ec66d3454f3e475f4d0ed89dd30101247e5ced
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 321d0452bb7450244abc37a4ce1610078f93ef1b8777478f9ac43fe7d949aaeb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d79d47d96ff88a9abdc84c406b9de0c067b7463d91a9c421356a69f55de7c70b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 33096b6ce88443acfa572229797eea95e38a52cad04765422eb5b1496f376aa6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8b7cf85fe1f6e3ef99f528545814189f8a999121aaa206b4a488c18d2ac10126
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 97349e520463a807ade2351b3394e6c44149666c6b36da41e401d3f2a92d0d43
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 851ddea65e304bc193ce818ead68e25ec08a6c5f5bfb53b4215dffe11413223b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 603b48bd9ee8d27b9b021a09da5c67b0923d316a26f00d09b8374e64dfa4c112
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c539266bbdead3c7d8ec7d779c55eb4b62cab6da77868c1e11ad43341cc2dcef
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f1f7d0017fc9712bd17a42399d4d5a3df5e0b96c8d953e82971bbba849a823a8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 571a8663811a887d7e3008a91f1922b874e60d4ef5f8451be0d2fa9b67994d2f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7fd679937a4ad579b79c782038c5c708532e458d62367f75c369ecd8b8fe8f52
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 87a8e2fe58da07140075f4e967e04c28fc71e3448517dbf1ba31bcfcd636bd28
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1a0eb8bf730072233c03c85819c977f43d0917954e0d24b44674c5131f2df26a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 492cdff047fd3dfe6c12a004f507ef93a4fb1034939871f121eb50d07f76313b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4da9dd93e02a67a61c3756625e23d96b81846149e9ad211a93c1e43328519046
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3d0997696d739fe65984c7d8b39549f5a98b03de117bb588b8177320ca7d70d3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5e826d666188ff6d4a4d784d2277a0571789f1f8cfc126fdc156c0fe9200cd07
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d198a7d93ba757a5cb13a74593bc44a0785d51d280a8b4c68f3ecda7f5c485a7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 38d71191902c66902eb69077529b5f1a6ccf173151ef3d27c476d366bbad3970
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7a200dd0e36ba0dae0626df7aefd52a2d29e9df6dc747a1781f7ca448bd91321
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fd634010b3e4470cd0317e5c9d77d74eeecaf3056596f7576ca38eee64157fbf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 64aac8490919934078df20df8cddd2e111baabc23a952c0b2e13560f11ef3554
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e6b54d8f26369d4a07188808c4e9d029533e5cf27ff3dc546019ff4acfc9e280
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 06985068e01fe975fd7a99c84193086fa7b5507483b46c490fcff1182b4c2faf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 65d9d279c8cc861263e626aea5c7297566b1067907e5b9bccab7b14f53aa33c1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d9b45139f7fd00fa70479b5981e2b4a834b3d2322639fd801b303ab5edbb0725
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3b73d50e968b2036d4b5a9385b0b5236458f1c62d3081e6c9ef7d8cc20c7eb87
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3226a4123c38c1ca8d1aa2549ac74d5592bc99dd955e0302dc962239b6f555ed
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 779840dfb5240a3b934fb085e532f75d95683abf3b6f2d1c99d9ce832c31ffe4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5a671bb556914081f40605d34513bbfe3025b60c3ca3491c69b7eb0b6510dc1c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2a534fd8b24702bec3608e7c0fd797e788907f323ef1c14ec2de86aede44426d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3830da5b91bda76e1f7b5239f85211e6ab519767c0f971a65c97856d882b0325
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7b14b80df626b609fc38b2d43b3bc6e7a8276a0f8532a45069ca9699212b5e9c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8d3d777f3cba662e4fb5682e4a935643920b43aee374e40f84d738faecdabb1a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c158087119dc234d7e2d7f1fc35366e0b4daf440f5b0b3c311a76f7e493bc623
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4a44b9e90b9dd786f35aaf68fe6fa36de38703993ed0bdd31631c672ea6aa3c4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7e8be9e93ea2b25852790352d1123a50f8d439dbed0479fb45b80c92859343cc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 39dc610b348a17840a9df49c44676a4c9993101149b267ca0f3d68406e520801
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 51addb596f91c43e97c0f4974bea062dbe3299ea322eee1d6ff1aa5810e7c792
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 398c231a071d55d5137cfb390adc911046bcdc9cc3bc91826f08f658dde7d05d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 00710b43fc088c31b2009cd57326bf5109753fca7d52cc4e7e02fe54fadcc317
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4edc7a9acff4b144b474c3ac28d9ec09c4d89581d3bf2e4f5c4d921fd8372f18
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 51293c2b9d218202632a070046e9d225db8dff91c57e7b6c0369fc27f4cd14e2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 97d3e93a6f01701bc63c58524f639131dc3ea7c6ef5a327a16d0b003c18e084e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 faedc346f4f7dcef25f72b02f0f28ff3427efa595dedcd90600146d6a48297f6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ca081d4d3b2ff45d65abc57a3ffa278181fcc75ddcb7927b20b440c4bf0532ff
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c336112389fff63bb297430328cce185469a67e5067b28bd8d62ce6dbf890100
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2ccd9604eb30eb2035048bc171af7d632271791463bcb9dcb4bb4991ccb06fd9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5fb9e6d5f49dc22295dd79b20e433a1f4eba5712faed34f2b165e26d9606aea1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 52959d37481318597707a4b789e1c29e4136d70e1c66f41d25a3fd3cae39bc62
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a92d0f1f43cb862969aa138beb6dc5b30e6db265573e1f1f8b43b1a7c5664b0b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f457daad404b6454f22ee4cfe692210c0b279ddf04c4f35748e6cd856c37e58a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 504b7d071c51a7d22d8745f542d743586da65ba5a8a0550c9ba00c9199ad013c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0c8975c4049d698fbe0727a75e4137f7ac2b0b8fbf272bf72fd601750a34d16e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4838606c5e258823858911a0e8203d7f9818541c5fab521ce439c82d3552b542
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8e9ce27c4e274587da6dbf187dceaf9c63af6feadb71fb2be2a7af2874e09237
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2edba8d8f543deecd57435a25240e0de68a11bc4cc876b8db78a5c233e0078ee
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a431ae5fa6c274f564cb392dd778ee9b161dfeabaab3f20f67828fc179c9b0e5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1e227e4388cc67e69e844ae5fef52e41fee64a159d48b9de8699af434c10ddef
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3eba4eab1ff5a5fc03908efdd2b7fb21698e52fbd517f26173115732335f3e6e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5feaa5732682971205340c7f220b41093bef95a6e741488f930dc388b12a4c31
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 517511194366e77d260be94539a49c47de9a1fe534398ed0272e6ee7dfeeb2ef
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bf2b9da97d9b5eea67ffc77b6461e341cefc4999283ff83a3a7c241b8ce2da04
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ae8f09b11694baa606475bc78b02d14f747038eaea2a71bca281ae97d9d54350
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0cbd5569bcd50ce4c20d43a390cd60d76aee940b0269b15d5cc46967ce1fe3f7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5284195f90fe02985fb41ffe7dfa01fe9947273d87d564c9624160b5842731e5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f5aafc27dfbf096742f296b186af53f900f05418e6ecc2d850bd144ce29912c6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5921c3a3364d3c97215c1171f667cead4227df880651df12b05426f947291de5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3678d02b8deea6007fa91f446c330b00a7bb5840b8fc3b5b8b16638025c042aa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fb557feefd8fb3e65b52555a10f4e380d29feb6e245a261f3f0d0c715d233c1d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 17e9630f575b29e1d11cdcefca8e35ca2821d7ab89ff8e0567b3e75ab9c2d6e8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 044e676d07b9e61d382c9cee65c29cb945e58187b2e26cd9309b2a06b63b1fed
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ca7c8776d907b51ad18b7b3b178d962d5350c2326857f2bdf3a1eea12b030316
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 48d1455cde146f0f4545a39cacfd68b3b2294be4dbdb605e0fb3680a3ff66991
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 53a436ec2122eedc76c3f261539435f455779a016464f4653f7f30a7b663e44e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1d5409beaada3d3ef3f487c472651905fbbf2d98c3a679d1360d27c44fba2b2c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c3e6133a27d0db9ca7733a8a537adf7fb6956daa3de996132ecf6da56359b74b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 593f70fed2f920788ac1eb9638687b511c241580b92ea390f081587ada18d2eb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 375ed24cda2caf1fa3acdd092af9c63b6293dd135a9548b2529b18c832606aed
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2ed8137284040ab9828596207e5863d23d6bc4db13dcfd324bd182e3863a448d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 756de1b4b28161eb37e0c44507fb534d252c901946072ad7cd96931c325e88ba
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0ebac49ae03332af0018d97c4c73d403f210113e0d4a56d534cad2a778e81537
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 66e77ab8bb6c3cd143431930c12d090e9c83adc6c726fa48808ef368f31a151d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 39c31f9bc399c218a7da8d325f4aee9cd1c08ede51d1b2c3171b3d4a1120fbe9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 089c81451c9bc210a393609174e63b2081f134d9e09273c55ab5047652a26d5b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5e6e33c52bd9aaf51c878ba351600e16f0b0cd16f75981afeedb3f5db1f5b9f0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6f7e43cae5788391cf1fd1c8f503b813f16732337ca9a7e418edb3fadfd655f2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1099b831a566959f7b8b6eb51812e5436ab14572bc2b4ab7553e851f44f5a2b0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 62ca734b99ee6f12bc7a1ee1ffe4df917b5ceedb92b4567704c8463d38b6255f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1df6399f9a0fd2116638b37b98413de9f7be6df28db1319f4e4158da43bf43e3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3d8b537624d7524a826170318647e77e05ca4d1fd35febbb43f06437964f8638
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ead02726b792ce4dd7713915f44921321cb6bd02674a722ad77413ce797fa2ff
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f2e08094f3f0e38953a8b3c39a7cf7da0ade40cb3aed95ab9f737b7ce2ad9b89
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5bd557cadecde6994862d0e3055ee23eb05a1dc75198511a98b06e15dd3a2115
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bb09d3fd394f189b63773ced5b45c9583c923bbaeff4005f8668ed6cab94cf0e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1765b7a0bca8557441480028837a4c55a202367a44909bc8cae6768d075c1dd9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 effaf818a9b0bb0aaedcfe888039f45e65f29ce59d786a81abf4f7e06ac1b97c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8475bdfe878750f0afc55cb1000faabc12559f6b5b3b67c4d9f247b15773a4ca
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0ed23f01c7a3fc08aac14eccb50cbb0587f2e29891776989d84b1ffb73227543
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5140a19966635cb36dd93f132700b82c5df8c95d0da47c56c530006c76b3a0b2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7afc66697d2b07dd5d2376b62a873ae90238ccb7d00a254e29a76afc17dc7db5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a211f1db8dfd958b7553c18fc12f2e6754a3377e2cc36c1296bb3052b3044f01
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 54fc91cfc7eda976d22feaad4f4e6059c84c3e6d352af4b96810845bcb388191
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bcd499c2b243c4a28cd2aa5058365dd4b402ce5f2e1672e3a3c42e2b9a8b07f3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9d6d12cb65c4110c10bf9f486b171780b1893c75bf99c22c1b5c40e47c03a3c6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 79ea0bdc829c837479965b1b367707a5ee1cbe77eb50727bdcaf82c954a288f1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6c1365188f9d3872010a14a6ec7a3fd6cae1878b2e35e3aab929f1d39d5960a9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0e16b2dbbee2819eb880539f88fe775b553bf6b0408a061ca71a2482e75ea4a5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 55af9a48b50c46465f166ff371d64c70c42a30c245d8ddbd536a2444aba93bba
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 96b289ad906695ca307a52268fc5cb1479ff44ff614ad487ebfbf63b0c28d650
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f5372a2e60a2c36b29c36738e4c801af8116410c581258f0f4591f4087672942
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 48d84db2b29835bf9df3b95f42e8977b3a3949e61fc0ea7d5f6f61b3bb54743b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9f381ae0a57eade5118060b80c8463c8a4a6745319d84fd693810f90f4236f6c
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
            • MD5 SHA1 SHA512

            SkYNet.exe

            • Path C:\Windows\SysWOW64\install\SkYNet.exe
            • Size 290KB
            • SHA256 4b50f5f1e8d8f35db928f5538e3a84ab3e12134e1d89333c0a781491e4e29a2d
            • MD5 SHA1 SHA512 SSDEEP

            memory/2324-1377-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/2324-8-0x00000000005B0000-0x00000000005B1000-memory.dmp

            memory/2324-7-0x00000000001E0000-0x00000000001E1000-memory.dmp

            memory/2324-69-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/2324-67-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/2324-66-0x0000000003CA0000-0x0000000003CA1000-memory.dmp

            memory/2848-63-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/2848-3-0x0000000024010000-0x0000000024072000-memory.dmp