Analysis

  • max time kernel
    150s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/03/2024, 16:58

General

  • Target
    bbc932f9ffdf23d656887fb4c69683ca.exe
  • Size 324KB
  • Sample240308-vg4spada7s
  • SHA256 79c5d2f53e5768b2fbf5208d57ec7510ee48f0040f154014b9ca8a8015776b27
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • samer77.no-ip.biz:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    spynet

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
  • ASPack v2.12-2.42 1 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • UPX packed file 12 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 5 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3468
      • C:\Users\Admin\AppData\Local\Temp\bbc932f9ffdf23d656887fb4c69683ca.exe
        "C:\Users\Admin\AppData\Local\Temp\bbc932f9ffdf23d656887fb4c69683ca.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3792
        • C:\Users\Admin\AppData\Local\Temp\bbc932f9ffdf23d656887fb4c69683ca.EXE
          "C:\Users\Admin\AppData\Local\Temp\bbc932f9ffdf23d656887fb4c69683ca.EXE"
          3⤵
          • Suspicious use of SetThreadContext
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3052
          • C:\Users\Admin\AppData\Local\Temp\bbc932f9ffdf23d656887fb4c69683ca.EXE
            "C:\Users\Admin\AppData\Local\Temp\bbc932f9ffdf23d656887fb4c69683ca.EXE"
            4⤵
            • Adds policy Run key to start application
            • Modifies Installed Components in the registry
            • Adds Run key to start application
            • Drops file in System32 directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:3456
            • C:\Windows\SysWOW64\explorer.exe
              explorer.exe
              5⤵
              • Modifies Installed Components in the registry
              PID:1108
            • C:\Program Files\Internet Explorer\iexplore.exe
              "C:\Program Files\Internet Explorer\iexplore.exe"
              5⤵
                PID:4916
              • C:\Users\Admin\AppData\Local\Temp\bbc932f9ffdf23d656887fb4c69683ca.EXE
                "C:\Users\Admin\AppData\Local\Temp\bbc932f9ffdf23d656887fb4c69683ca.EXE"
                5⤵
                • Checks computer location settings
                • Drops file in System32 directory
                • Modifies registry class
                • Suspicious behavior: GetForegroundWindowSpam
                • Suspicious use of AdjustPrivilegeToken
                PID:2080
                • C:\Windows\SysWOW64\spynet\server.exe
                  "C:\Windows\system32\spynet\server.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious use of SetWindowsHookEx
                  PID:5060
                  • C:\Windows\SysWOW64\spynet\server.EXE
                    "C:\Windows\SysWOW64\spynet\server.EXE"
                    7⤵
                    • Executes dropped EXE
                    • Drops file in System32 directory
                    • Suspicious use of SetThreadContext
                    • Suspicious use of SetWindowsHookEx
                    PID:760
                    • C:\Windows\SysWOW64\spynet\server.EXE
                      "C:\Windows\SysWOW64\spynet\server.EXE"
                      8⤵
                      • Executes dropped EXE
                      PID:4704
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 540
                        9⤵
                        • Program crash
                        PID:1944
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4704 -ip 4704
        1⤵
          PID:208

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              UuU.uUu

              • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
              • Size 8B
              • SHA256 1a9e69094ac8aed0b5825ef77824405d6eebf11b40bc9c0ed6ad570db365e991
              • MD5 SHA1 SHA512

              XX--XX--XX.txt

              • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
              • Size 229KB
              • SHA256 d941d03ee0f3c955733825df94ebfc6496891a90f3541fe5213773c4ffc88ea8
              • MD5 SHA1 SHA512 SSDEEP

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e546a5890511559d2e24f0f6372e3298dd124ba87724d67196591dbec4aa432e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1305db3bc048bde9a57b4db40d804818e81419198267953c7e0859cd4d0dbe51
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 588885dafcd6f07deaf4a7c166ec3ac19f3d4924f6e25198446872d92469c753
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2b92fa4e0f962f8fccc6244d8e42e227c17d76c42cf435e219b08e7d3924e409
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7c1c1d0766d8cd0f6b735963658a0c60eee21d7e3db1d2d7d2cc1e7c57bd8dd7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ccb96f5aa63b0f3023d7638bdebc6fad78f0d740918083552d61a5d401839cbe
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6b3223a6c67c2cb293b571538d6dc3558590f29b9f2fb97eb8b8af335586fe4b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c59db29ed6c046fa55ab1332b2fad48ec0a235c3a083b98f2403431d2941e33f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 46f9106a21730070b5f315f5aa328fb7643bf32bddbbcca893ff30ddd048ddc5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c84542b2d04c4e62b3c0efde0f8f47c2e8a8dd16f8d97ffbdd25ba2a2851bbc6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 343b023d5fdc1741f0bcb86993979a72e9f6ed6f018a5e5765ea88789fb3f1b7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e8aedf5b7f025d537eadf3e735fbdcc256c787f9638e5ed5624cdf7b540fc1e1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d9dc2b69efa14c7f8ddc3680934f9ead56845c3d5586a3647baa3ee94095310c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f7713e24a7d441beb053f389ee31a45ac07964ca6ea922449afc4244f2b4b2aa
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a77e903e7f4c4c890f89c5944ad1f14e5bf7847f711c37ec9f8cf6d8301a293a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 db9d16adf3a65366532ac2e73fc56c713844c0d66acddbf5ddaa56cfc3ac4c0f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ce929f1a02cad1ebdb7ed5dcf8aa0817371df2c68d2941cbdb391e3b0cc2db40
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d8edb6d60510b46d6a6c5474cf6f8fa8709d18ceb4e30fe71c39b259aacde0bd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 df3765d1df8b5644caae67cabc2972f8a1139df96126603d124d7387c2cde756
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 46a651f262f03bcaaf92b0038bc04519fcb4caa0f4df1ef029ad2471a35e27cd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6f8ae4d2ed9448452312f015fff826a1ec93bdcef8024457a80a06df7e5ea510
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 599cdcb46750047bf13d256f45b199c94b73cd5dc9a42e3f1ca1d5c414c53baf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b7427d99fd6f54c1ce4717c1f925717562d008e1cf2c4029e714ef843840df0c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 da5cfb86c8ee3abc26278f1d160f3ff99cf8dfd56d3732c49554d0b6a768e67a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e233b4863d789577b866fb6f8112c939d4f26d0d44b5d0548e1a316a8831431c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 162983fb3ec1700f4160f5d5cf90ec2c9175ae014d665ec1bbddd1e9742b77b4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5f09889748d9cb2048c65552f30f0fcfe7546488ecaec41b45e35fdb628ed253
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d0ec16abc2ef20374a13cae77d63ccc84ded819ea05c6c65d8f539d431dcd9c2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 192bb6a0a73805b8e19be26a1ed7e223b4411f8c2a97505b59f2b2c4329b8940
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cfc69c922b53c723d13ec49effab82f250e21e2d08c7af160949f95bb99c68cb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 01aa8dd80908284a8adc1327bc9668a8b95c142e9be19cf3d5ee8220abd217b1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b0fb02ad8975e597b871ffeeb12b4fd54bfc8dd01bfb27e835306bfaf2ee2d75
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2494a913132f03ad17659860cf1de273c875c4173108fbc975d61d7f6876eb4f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e1c96ca7f519c370420298ab2955ecee23f23b27487204f5ed3e2fb8c456f097
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 715880ea1ed3a5418148bcd2430b1abd4f5e2c4d0b7cf850a59f5d54102884ef
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bd61f7af038af868bc87377d8fec79bd95311c5f0f013fdf1a1062cb544f3757
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f4ca69ffa15f171905ee6cf041ab976e365ae1e0ba556d5974a4dff64ce25c92
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 56830024c9ebc8422af978f6766b32a22c437fa8b632485b86150083d6d2e828
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b7f727cb48aa6bcd36af245bb62b22da698c6f0782c696facf64bdd7b18bb0e8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ea5d966ae6af977c5c3f8336c2ec5cb96c5fc743b642c228ce80193c5cbb6f78
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4da114ecae69232933c677d3c0990abcabf31e5a823faf7f5d69039d8064785b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6aefe4c89f2bf27d94ba5868630c3200d5f14bdc7395eed2a20b4ea6231041d5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b658f645ddcb0e7aaa1fba38a75710d6262c9a8d3ae3ccfcf34f32129f1e626d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 913fc15de510380f76e7bb1770e98683a85844a60a716f36da80f9d15af9e0b8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 55c78d6ad8f7618f765469ae8a8cd491e15c0ffda92a8addf920716a09072cce
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 93beaddf7785481a1825cbff9d879d65773a2a17b8fcc0f2faec36b1d39654df
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6da62b9d64d7019ced3603dd5d928041991794400f7751f04c5e33a4b6e2799f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d90ef4fd339ad9ddd7924cb288f349f9a7a6f52680311099e778dfcd9aa93396
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ddc9a63f8325b64a743bc254feb9ba1b14c77114730c5f3fa734dcfbc5b39cb1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a7ed1d3b2dd63625252e4c76c891e1eaa676b3c055b9633ef7f1c10901f20ffd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fef5cf771bf875c95699bcfc0e5115f4f7a3713a82fcd91fea9e6e9c566cd833
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7c2977c9d1e75eff1e8b5b80bfefc76556cc330f851380db752231349c35b763
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d19cded61f2842463315e38345bc37b0f114132de820f460ad0d013d322140c8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 433c3707cc82dc4ce84892561b4ea471d0898c77d970101197cba6a481a16afd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 82755c2e7e0db13e1720ca6bbfea6206db8eabf45c9f16fdb7b0655c3e625697
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b31aa366e2552b48be9e68413448b8a897e41b087b98b11c45bd17c8985140e4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 45a0569cdb2f11424e6a3af20db3bf683680d9a3aa3fee6c3d3e38445af2be1c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b7a9cc271aa8175bebe1338f244e56e1c76a75371f214cbc792643f5fe6d85b7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cfdc0dbde3d5dc417b2abf7dfd7eedd895e8eeca9544c38942a123281125e812
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 968b40c550220735a62f80e8df8da7a617602afeda8dd1e5cc99d314fbafd4df
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d3f9a8bdf47e27468d64764d69935559daf641d64d5579e3016e30b9eb3ef378
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4fe0db0f35cf212bc74546d0f5744983a8712a1979d675045c21fc0f82865618
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7c194188324d4c2e030dd73117b5fd02b2169dee3c3fd25bf36e8ee501a25a94
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 38bc3f295cdf6d325da33bc08d8344cd18d1efa0297df5c20fa57323e08cda56
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4aa0d021d8c450330c1ceb05c41c7ba55c9556d9b6462e5d6037fe065939e4ea
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 94795dffb5494980bda89f7824a240248ac610e8765b73df931c8484f23d7621
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ae41d9bb2547ae07422b98c5305ea7a8614a1877f7ca8f0bf71d22b75430dc2f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4962fd9b8762854f59a5038eb4de9abcfd981a16d8913a90854873d44be09fae
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 437c9b4ce391e8d3cac46b3d0a8e8cfa1fd93aa5d7a2278899d90a2c7186b676
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2ec88a716de22aca2c2dd5e2d6df8b7a372413761d11a5bcb9ae0c5b98281515
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a1c3e0109f64208a98dce4255b9e9f99a9abd5480ac939c24fd07f8373c2f4e1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 65eefa2b4ad839454ddf00a5eecd9f1c56dab0f4d63af37c0e5e44fb4be0f4cd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b317893a7ee21b9249bdd3c827e134806414591883732fd37ef37a748bf9eee8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0c39a4210b386712f3a2eeea579f40d3ed459d04cb5dc9a131a53ba0b88364ba
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 928deb99f4b6438e298519c53b1e97b22e93c7ca6d9de850729cfadffe7f1851
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0565eb76f278592312bb2d723d89c028bc7c4cad5875c0cc6c0379350d758cf7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c746b92016c2262ef258c767f6a61e6e0a677c7d51ea0f7ef4a332e417175caf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9674bf6a12d263a48ad992392b831a7384c0487e1b07f0288b969d47697ddc3e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9174a93e66d70f1b0901335f59def2a4b79eb06cdeec38f1211242df9e7bb8ac
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 11daa8e937a56c94986efbdd27066458a594c6147dcf23c0f1db6bfab9411a39
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4acfc765b102df3abbde98e461b3ba73c37e73e7292f3d4773a6ebe95a825343
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 adccb404083a669bc8ab6aa808faf5d6df20fed0c7ea57e8d21271206c224457
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ab055fe921d6edc7d29954e9360b0a30e4e8ef96e845e80f34191f299d69e70f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7597d46bccec8bebaafa87af1354e3317ba156e437c5214640aad7bbbdbf9a8a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c8e4c03d7a1443b3308f55b08bc3d6a139d0e37b2df5e1865f06e2c34683ad2d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5966d5739fdf94f03561abe22af49c608236e6b17f08a5c62443943a7cbc5181
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d7c50f5a2d26975abeb70075f5f9fb650910748d010e0f3c53802bd07ed597d3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0419e5c2dc0de0add6b1dcd55f81f53686d113992ed0f32a25d2daf7f88af53d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 47887126462d17ae3eb544d8eb83b03db3e2d5bc9d80c5bcf4f0884228e237f0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9aacc0046b5fb18a6a361fddd719884c66fbe3c815a78868a89c16c40c9b1335
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 41a631d9275108283bea5a420c8d65ff5d283546d455bdd3ef783f3c43722c61
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5be37c37404a3e6fabc7deef86e9dda540807993bd9e516a3a06bc15acad080c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7d630eec3b76aa7b2dd79e89a9c99b03e33981dbe72f54b63c2a4cefba1f5385
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d83a982d583f4d7a5c54266ad0ef6b033c13d7fb0ca4595e5a578a8b0c3a64fd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 61ef8058c00617c55dbcd66cce840a0222c5ebb2db143c525f09fd3b7636714e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 08748d2ff9ecac4c9f575be820e4cfb5dc0028634a800cb759e4c8ffd53058c9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1900585b4fbea9bc311acf53920a852441d5ed7c3d25d27ed16c889558f888e3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 018af9d5604d8868bddcefae1e34ee699a96097f23523a1f23b69143a813d119
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 61306af2a6e9664d1c728712f7e7e8174885225cf6939f3276bc7c824d17f5ba
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 34128dceacd4b1c20964a004cfb8c2f4520ba0024d7bbcfeb6e0ba93b528bcc1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0467a2535286183235841ba721c6baf18dcf23720f27c99580fc32c3de906385
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a6992f5f83cb3ceb1fb1dc525658ce4f19a691a1d6bdf474386ecb0b1ad6f72e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 67e44a4db3314e65277856c6f922143c910f1cbe618f6977f00f92a07324a695
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 363e79353a4e24a79b87762c55dacf009e6be23e956a6df2aa6a3992d8f8c28e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2ad8b8f817271d7228add85630360bf1c0a6ee0ea7516a75fc419b81cd550cb1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 671fd23cf6c4b18dd3fefd4639304e5b8781a357c6f244d176963ff6c4557ad2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 528b659b232de49e90b0b5defbe03e48aa19c355b62978cce087beaae2dbf717
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c5be42d215c304916e7df15c010d1d751a4a910d565196e1ef10dbb8b6709e99
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 279c5adbd1e2f8b8e94faf36ba9f8147dfdbda213e50ea86685ba51c969699c8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9ad33a77e6f26174d7177cefdeb03dfc02b0730181d0fc3535c70299c99a689a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 279f904ca77602d9c0927f5e85cf43569a687d0ca9a433d7d371ca7182ebc383
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d5e81227dcb60801dffce75ee4850bf7581072d955f6fd355b0c230a7f5678a1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8b7f6ac374316101e70e0b1e1b2c98b603d98f0fcc80ad11fce579fd3f0eae95
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 46be701ce3d6c46a9fa575842d89ee281994ae7c51f303f6181d9919868adbd9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ce461adce4ed73d628ba0d97841fe39d907ed5ed1c4fe10bd69ae4c04b174e63
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e1131c3bb2e9d3293c55ec7cf72fdb6c1cf02c445414eea2c8b97b76aea0f842
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d6949d4209231a43fb555080497f62bde0cdecae01b27eb05317f646e88964ee
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0ff3417aa9bbd9190acd7d73a84ea74006bafc594145d86deefbbee3747ba5d1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b30f7b178b3e6cb3226749f0c44644a88041d0baaed6577795124e845d5b8b3b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b90e8d752aee7596ed5f4cd4922c76d0abb7bf9232ab998c72c8f8716ddc8bd6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7fc44aee13dfc6313b17e7c8da5d6973d6e064cc4a4acab0211ad5c807da2b6c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d3a924138aba75fc5ae1cfef587f3a8114f099fc011a52aae10b8ca4165e2c17
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ea94e1e854675c33e6ef55bded5bd2d4d9d66e07ffb6adc4e8c72ae4d4a5f1b4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 564c7cf8bb06f4bb311e75a479e192bcbd71a8707548b7add6098b9c1d0be3f6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d7243b68f58bf852d296b7c2d770acad4c26671c59a1f9e7be86e01a536fd3ed
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 271e2dafeb19855b76cc2d68983b4b52f282458525edaf4790421ccf3151576a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 857d6c8f48b16f5f7ec281f12057a55a2a25691ba298b7728298a42423fd708e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 58caf5b9fbbe4ac4b4c86de17f801422d041ce2ceef4a2bff130645877493e8f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f15f88b94f56e7e88e0d1e673d9196c6fea043af6963c1ff2c56cecc818ba61a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4ac3d474d1ce3f8bddcc10deb46c4fdbe53d9a1551aa5239a5efda074d55d030
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 151f74485abf09bbb3618dcd8d681aa7e755f4d3af7c34d9d4f01548a029cf7f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 10589875902e7fcdd7031a0e92f273c7d3fbb10185e94290606c9a0d5b3fa32c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9bd1584105b05b0ec62c3f2c143d327df9f5e1d8782239fdab3a206ebd526c82
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 22126851d4ebd0a62ac5311345a3df4a731b248188d414e02548f8e3a80be3e0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1082200103db80bd28dc99b6a51781c27e9ffb60dce6af7b357cfe61c024337d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a5f4e45ae63bcd6e8b8824594721848f1144a7a2945e7da7d65d0408c74bfe50
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 63bfeb975b3d3236b47139ca6c9fae35191a965607aa06d4260516af65c07990
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9e114cf8751ea21a8eb50b36b2aab786a04fc7f16e600d621c79297dd2cf2c0e
              • MD5 SHA1 SHA512

              699c4b9cdebca7aaea5193cae8a50098_54283972-31eb-44bb-adba-4e057460c33c

              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1497073144-2389943819-3385106915-1000\699c4b9cdebca7aaea5193cae8a50098_54283972-31eb-44bb-adba-4e057460c33c
              • Size 50B
              • SHA256 4d93c22555b3169e5c13716ca59b8b22892c69b3025aea841afe5259698102fd
              • MD5 SHA1 SHA512

              logs.dat

              • Path C:\Users\Admin\AppData\Roaming\logs.dat
              • Size 15B
              • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
              • MD5 SHA1 SHA512

              server.exe

              • Path C:\Windows\SysWOW64\spynet\server.exe
              • Size 324KB
              • SHA256 79c5d2f53e5768b2fbf5208d57ec7510ee48f0040f154014b9ca8a8015776b27
              • MD5 SHA1 SHA512 SSDEEP

              memory/760-194-0x0000000000400000-0x0000000000406000-memory.dmp

              memory/760-206-0x0000000000400000-0x0000000000406000-memory.dmp

              memory/1108-26-0x00000000005F0000-0x00000000005F1000-memory.dmp

              memory/1108-205-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/1108-27-0x00000000008B0000-0x00000000008B1000-memory.dmp

              memory/1108-87-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/2080-691-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/2080-160-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/2080-97-0x0000000000400000-0x000000000042E000-memory.dmp

              memory/3052-14-0x0000000000410000-0x00000000004D9000-memory.dmp

              memory/3052-5-0x0000000000400000-0x0000000000406000-memory.dmp

              memory/3052-7-0x0000000000400000-0x0000000000406000-memory.dmp

              memory/3052-16-0x0000000000400000-0x0000000000406000-memory.dmp

              memory/3456-15-0x0000000000400000-0x0000000000455000-memory.dmp

              memory/3456-18-0x0000000000400000-0x0000000000455000-memory.dmp

              memory/3456-12-0x0000000000400000-0x0000000000455000-memory.dmp

              memory/3456-17-0x0000000000400000-0x0000000000455000-memory.dmp

              memory/3456-22-0x0000000024010000-0x0000000024072000-memory.dmp

              memory/3456-158-0x0000000000400000-0x0000000000455000-memory.dmp

              memory/3456-161-0x0000000000400000-0x0000000000455000-memory.dmp

              memory/3792-1-0x0000000000400000-0x000000000042E000-memory.dmp

              memory/3792-2-0x0000000000400000-0x000000000042E000-memory.dmp

              memory/3792-8-0x0000000000400000-0x000000000042E000-memory.dmp

              memory/3792-0-0x0000000000400000-0x000000000042E000-memory.dmp

              memory/4704-207-0x0000000000400000-0x0000000000455000-memory.dmp

              memory/5060-193-0x0000000000400000-0x000000000042E000-memory.dmp

              memory/5060-184-0x0000000000400000-0x000000000042E000-memory.dmp