Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
b243152e42bdcedff977da3caf69b71e
-
Size
572KB
-
Sample
240304-qw9j9sbe2z
-
MD5
b243152e42bdcedff977da3caf69b71e
-
SHA1
c7358548810451d9fff6cd2b8db17f3731cf1b21
-
SHA256
71f468dc75d731d7662810a2d547dfa0c1b4514b045a99af33e839d662bb4479
-
SHA512
5d06d057720bb62d13a2856c2edf540c270d474053d0720a8da008c20b071e8855572786cdb1d7401b50a033d1ca0fdb518a555ae017d1f7cd6ce14bbc3da31b
-
SSDEEP
12288:Qvvhj5QkG5qxPYXv+RwN4Ft5FmnE+SX1kaqn:QvvdqsPYXGRwNOt5FmnE71i
Static task
static1
Behavioral task
behavioral1
Sample
b243152e42bdcedff977da3caf69b71e.exe
Resource
win7-20240221-en
Malware Config
Extracted
cybergate
2.6
infectado
blazke.no-ip.biz:81
bucad
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
Win32
-
install_file
notepad.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
texto da mensagem
-
message_box_title
tÃtulo da mensagem
-
password
toteking12
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Targets
-
-
Target
b243152e42bdcedff977da3caf69b71e
-
Size
572KB
-
MD5
b243152e42bdcedff977da3caf69b71e
-
SHA1
c7358548810451d9fff6cd2b8db17f3731cf1b21
-
SHA256
71f468dc75d731d7662810a2d547dfa0c1b4514b045a99af33e839d662bb4479
-
SHA512
5d06d057720bb62d13a2856c2edf540c270d474053d0720a8da008c20b071e8855572786cdb1d7401b50a033d1ca0fdb518a555ae017d1f7cd6ce14bbc3da31b
-
SSDEEP
12288:Qvvhj5QkG5qxPYXv+RwN4Ft5FmnE+SX1kaqn:QvvdqsPYXGRwNOt5FmnE71i
-
Adds policy Run key to start application
-
Modifies Installed Components in the registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-