General
-
Target
c6143f1dd9d833e1d8169d02fae66763
-
Size
492KB
-
Sample
240313-rg5s7sge52
-
MD5
c6143f1dd9d833e1d8169d02fae66763
-
SHA1
3684aa3ccdc52b40f5e458ff03765e716c44477f
-
SHA256
43bd2b808c5af0216b2438a10dadaf2521bee7235a52f4c3c303b0b63f2341f8
-
SHA512
d46bf66d3ecfdc00de158de116febeaf9076675b06607b6cba53de6512f779820b59bd8c93072c9c6331474e47b49a87c120def92b8b0142f27f98337a4d4030
-
SSDEEP
12288:vNFS9o/liSZnE+NfS4QB7HOs1+9vYbp+DWJz:vHwoxi4QB7H109vx
Static task
static1
Behavioral task
behavioral1
Sample
c6143f1dd9d833e1d8169d02fae66763.exe
Resource
win7-20240221-en
Malware Config
Extracted
cybergate
v1.07.5
test
1234host.no-ip.org:3460
7IMGN084E87218
-
enable_keylogger
false
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
install
-
install_file
update.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
1234
Targets
-
-
Target
c6143f1dd9d833e1d8169d02fae66763
-
Size
492KB
-
MD5
c6143f1dd9d833e1d8169d02fae66763
-
SHA1
3684aa3ccdc52b40f5e458ff03765e716c44477f
-
SHA256
43bd2b808c5af0216b2438a10dadaf2521bee7235a52f4c3c303b0b63f2341f8
-
SHA512
d46bf66d3ecfdc00de158de116febeaf9076675b06607b6cba53de6512f779820b59bd8c93072c9c6331474e47b49a87c120def92b8b0142f27f98337a4d4030
-
SSDEEP
12288:vNFS9o/liSZnE+NfS4QB7HOs1+9vYbp+DWJz:vHwoxi4QB7H109vx
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-