Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/07/2024, 13:24

General

  • Target
    227f358c03a4596e1e1cdf5551f5bc74_JaffaCakes118.exe
  • Size 493KB
  • Sample240703-qnvfdayakh
  • SHA256 c67db068ab3924bafae2185c5b28ac5a0abcd4127f4bc3de06699091ce030869
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • v1.07.0

Botnet
  • remote

C2
  • ghostprotocol.zapto.org:4444

Mutex
  • 7M343DF5US32U8

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    cybergate

Extracted

Family
  • latentbot

C2
  • ghostprotocol.zapto.org

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\227f358c03a4596e1e1cdf5551f5bc74_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\227f358c03a4596e1e1cdf5551f5bc74_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious behavior: RenamesItself
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:380
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      2⤵
      • Adds policy Run key to start application
      • Boot or Logon Autostart Execution: Active Setup
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3596
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe"
        3⤵
          PID:4900
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
          3⤵
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:1804
          • C:\directory\CyberGate\install\server.exe
            "C:\directory\CyberGate\install\server.exe"
            4⤵
            • Executes dropped EXE
            PID:644

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          Admin2.txt

          • Path C:\Users\Admin\AppData\Local\Temp\Admin2.txt
          • Size 224KB
          • SHA256 b7d8465c84277dc21774cf38db89b6540442878a3b5faca1f587aeb4075b4def
          • MD5 SHA1 SHA512 SSDEEP

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 51bd47989519ca2e71d459243bde0576116b9efff1d450abd2cacadc78e8ae13
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 9926a96ad6cd416f27a51b656fe26efff2742dca12fcbe6b4bdb522872929298
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 b0e9d8f03845a51ec505549ed3c56ef7897d37b98242d06ca982c4797ac4705a
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 850e37e92aa7c6f1a0c1d0eb0d1c09b73050f97a3c0a2ed6691ff6011c4baceb
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 0c570970bdf97db25ac94efd7ba21278ea1fc6529bcff8169f25c5fc84acebb6
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 6e197c329c2928622bce7ea205539865daf23baf9bb3ed12d27e1e73e82227c5
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 b2157c1cab5a4c40b554826995750086015acf56488c7793967fda002b98717f
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 eb9ae7493f1a4f90a66259f5aa96bb95b994e9236b51af3bfd55a7bfe6cdd67f
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 db1e38c6c4e312b7a5ddfccf2c3d6b6eb5e9214e9b4b8a69499df475bee8aa1a
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 e2e5d6900e7503b6a2b834ba5b6f254f7ceb3c3e459b66ef167c7647b8ca602f
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 953b312d13707412f13816be3f61dd9aed3453cd8e58e8cdf3cada5ac352f36b
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 72faf41c4b62dda67419361d3d32fd849b3c7a4af212cbd402973a3c910d9d83
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 7e4802c05ad8d6266f9088cd455b7631c479b8b987da45f7301b861a1adb97f8
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 ab8adf440562db0d6659c08d2c9ea64795ee81e0dfa51efbb54c2a27e6c9d46f
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 1ed41acd78078f036d44a39b1511d06ff610f2d11f55a0581fa85fc37be33211
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 1fb340426521d5ab22c1036b24f4a4c76cfc84665928a58058273db49d99ec7e
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 d47f5e303b4273e77cddbb99f8697b94d7811d84c5da81aa65aee27ac62db2e5
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 7eed7c587121a616c1db9eba98c03df1a3e4fe146dde9f84b58ceb891d8762c4
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 6a3f857001658dc7eae0cfe9aafdca46c03e6c4a9c868527bcdafefd8677602f
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 68d758d80b9d73c4173005de46bd86a5981f36d8b40449c0586e3b75acfa7d18
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 50d865ad451da45edb67e91ab53430482cf5f274a743836195d96f7c2bf79c68
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 f32b3776077eb053b49be33f56c4b83298cbe0d8a0dceee1719dde15761fc5c4
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 827270d7fa5543e3f113c9d27201a6367b884de9bd166bde929076c0ae6021e0
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 c0b9972282372b6fac89f048dd7507d946cedd9b74a781a7acf3ebb16905d473
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 d9ee0c11fb38f2e207cd8686d755b01ebb3f52283a0b1d07f6079b4b8660b76d
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 2509b2d38d2f2f803be85fca1463bb81037f1dbfb82ffeba6bb4ae5a9b8dc2f5
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 a58e24c796c9eb12207ebbb794bab63b2749954ef6609da149862a8e0294133b
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 7c73d54ec85091de789a47be1e6323a8551aa6e32f6d547d68dcbdf009bfee1c
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 7b519068b10e6e6ad28670152ce131e67657950b779bd59e57d25dded8100d90
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 32a817846b2afba6778ae5bb4a6157f3008e07acce6c2f6b5a4141e89b471eec
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 cfeaeaaf34c5980f7b20acd257a53015e9af63d94023de3a4a73b0deb9875a42
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 3c51f4d034ffc40a8677282b33699ba79d65a25b1466501b478b31dcbd08246d
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 d40aaa0baa768367a445dcef76f58ef5a9860fe8b5906b9657733a947b8ce306
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 96bd3da43f8bb66d11da3d97686837ba6d741c3db4d732ca06336f481ac558e6
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 5d159eda0db33e50901d57e5b506f27abf7beb105a9993d71cccd1559a526868
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 bcaea05c3aa257a977c48f6f59063b2651ed2d64ccd3f62c919bb3213b1066f9
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 a65c738150edd6a382fc32bea08e80b98ee0aedc75cbffb43306118acdd6fa6e
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 33f7a37db637f1eb7da6dd822e773c918e84f4fad2c6987fd4a7acb0563b6051
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 4c940f52180751053c4b49a9670c63d2eff59bb3d9ff13eaa5a4d38acc693938
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 6aa0c0a362b220e6f5706be892851cb6052cbeafb3a57246c7f5e234b397e316
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 1eecf9d7fccfdf0bc1b1c4f6d21d841b6575571336978516835078458c452e34
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 6a94dd7a2e3b0998770e55d4185201518dbd2f89bfdff061fc0e667037551a58
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 288011cf5446cf81d774a4f1d012e20d0190fd45fca9f21c112d5a1ec94c58ed
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 d6d25bd77603daba873d2a7b9f2f386c3dd86670e9f3c1d89540bb5338f1fac0
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 fc2955bf6977cdb45176d3faaa71f2caab599a5af7aa5b4286a2cbd7709061d3
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 1235dd7cd6ec28bd3a793bf4aac5b00eca2d89888b5207ff089f7279373c5c37
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 452adb863cdd96ef77f55373bc148c6d58fb41b70918b3af87054ee018476b1b
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 26462c6b5ad1e5842848198d47aabbb18fcce4f5b9d0cc3e38c080dcaaa930dc
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 0e64ad4b965a1415e1c6b6b6e3cdc5ac3516fda8063c554d9ea572a7b643d2a9
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 eb78bfa07f3d83740dd5a17f5600b53c24b613169000b4a3120f6f630e847216
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 3536d601727b27b9d013a6099b5c2ac9c0758ad68dbc56745c77b056fdaa1dbd
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 3a80b09a8e1b611d953f9d756e99b62ad5ff84fb96d2d93cdcaa5b33a14d8d69
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 59db48dd38df55320947bc492bf67ce1301c26b26a11a876c973d816ea6a9db4
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 6b3750342509eb03ea52f36745f9f3c7a65505b34c5dcbd44cc6134d08e6cc82
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 3cf33ce0b8009216b28917583ef057a2afdc1caec6f94b7d3a855c251ab6ceb4
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 4895a4f44239984a84e9eccfe3f8982f68df148c2f0c1ef19747df015a14741f
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 9dc139c8ef88c508eb86c1af3cce797df2b7ab19fd0aa7db23148f8d6714b12d
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 48a213e42edfa62a0367be5d0d018d4cfbc31ee5e463c402bda718f781afe043
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 31cf47e9c9c161d9f37434e62153d718450500173440ab603e928190164c994c
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 8dc7dbb22461434f436c25d5b421c7366b497f4261f153c5cf51ea6f1047f32e
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 ab8b429ca0ce40d8ffb20dbe1c0c5c12ce8e1cbca05f8fe14cee9bed71c4eae5
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 4c513e77929e54131367cf9f3c0f226bfee5afdf6b6bd6faef5538d836ed9e67
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 9bc1549257f7bcc9bba24ae6adaa440314c775f41b34ffc8e04ce69000e7193f
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 ad42d3f361d697d534f076ff150926b81bfff11d4b436abc49a360eefda3c558
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 5b89bf616942984c207a3176ce58ad05900a4aa396d7a4741749b152c1ae1d71
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 9d89c18fe7d13ba650af56047809c0f19b05a5f5626957f4737f5eeb71f2c49d
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 de76a8d58ad6d0d432e83233abc6b2c2b7c305922ea3ff4aaec830aa97b78374
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 769190e634ea5375698d699c93bdf45948ae158f0b55ed9215920ee2f507f02e
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 c5fe341d36294155d099ef88e8bbc0bcb37a919fe9ada3f5687e1e30b4db3e1a
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 886d3a3610662a747a164326542b5de811c71a321ba5d05cdb1e64d88dbd2be2
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 91e1a21530d2b6f8772834585b6e5066d00d6b9d72ae7cdaf319ccf8ec30dd23
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 d4dd869fe859c32469448b54e41bcc2e986f29540326b48ceb77cd908584ac60
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 abea5e50c6cc98bd537b233c296be08b4ae560e3b525fe06e6f736e6eddbd032
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 6815fa287f0b0fee8fd7957b90f82d70271b153c27782c2d5d7513c15963cb47
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 92bb6e52ad118691a304e0845694c4c5a8a194197b5bd79421eccdb641ff2c21
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 62d196f1c08c99efa4dfd80863222b3850d6691c7a51ffcabc097cea29c07f1e
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 c2ddc42740f17d6450449a579329413668f5d148773693defdcb8579eaacb402
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 64c91aee750d02bc88eb36a4f3da0a169fe3144ab3a2735141d9dfa8a3f55370
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 86653991f731d7d2151be1ba5fc5c2a7599e9b257cf99dbb81be125b77c9f3cc
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 00d2e8bfeab338fb125e7a7b4d2fc66773e75015521d080c40485d4e3b13e56d
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 b1182848b124b541a9e3aec0123f17c070289903ca2f7e92b9c612c957275f47
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 9e41475b3109b9b2a1b0c461a9208833105027da2824efedf1c57e35e2f294e1
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 26509928366bcd3c94cb20cf73e0d29704cd32275bb1b669ffa2aafff90fb6c1
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 a8c020f319c4417a778ed5371de42c96df98357c787f74ae2c19fcfeadb280ed
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 4f58ec262d4579f614868962f6030d8946dea103f6b93888069fe43b28998cf4
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 1dd1ae15fa3a8121c1009bf19bbd90b2ffcf95ef69525841d23374b7baab58aa
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 082a4c18764f9057f700a3a8d520e0c65b592bcff6375f6e994187f6012ea723
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 6073a8353d78496b184d2d33a0715e1e1c7a00683d32086a69b3e4ab7e971a94
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 8efafdff746d4cd85b0a6c4a36ebbbc72b0d825e533927c52bb9ffcee4c59f66
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 c7d4960fe0a4df662b74395f85276c75b5964b1743d26bd5b79fac3340c211d7
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 48a8bec3f6b3ec4270e940f6f20341555dc1db94675f9a94ddf94ad6969167ab
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 bb0921082ac196a663ee76a38aaad2aeb5c8ca56365d7c3622e0e3accde5e8af
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 b056302f455bdb421f934aaca6b3b5d09fdff28ee2ce46ed922f5d89c3d9a723
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 385134bac4415eeb8b48c0fffa35847b94d6acc83165595221e99dd746700d72
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 87cb36c71848c585cd99a07595938f1e89d9363767cd14353de525e7c5f287ab
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 4e23c452053562c38f9b6eaf513b1cfc35ec3f7f39843a4233234f150dca81de
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 e55f444b44d99fe53ef1be2a55b761bb5e4076250ec6a9932dd654464b1d565b
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 0ba324e3608a968adcb48be040d4b31adaea4d49e95730913d3abe76a877293d
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 1230e2a16c42ddd5acf38113aa3dc11d3e4db045bb53f784de9a7db752d69147
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 47bba9a093205d0c75e9c188c74c0cd44d9d7725aab5825743fca57f649606a4
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 b3da8dd41616e4ce9addd88407a4cd4f599c595de212764d53509f4ff9ed8ad3
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 e58a703e21de3d918e35f5329b378c819a3d8d8616feb2e63b47eb554c65db5e
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 642ed3e3a241f982e78fd3d913b9b0897ca922e8f38d2a280cae1d10fb936139
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 3d6d9a5d04bbca326bf63b81e98669888b4beb37d1f35ebb357bf3bb02032c4e
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 4fefdf3aa2b836b32f2e4e0de1daf1273318744b3ebb15d1d037739089c65fd2
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 cbfcb79f8b8ac534e9437eb678e8cdf3a720041ca78b6d140cfede76557919ba
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 066a69f355f4f6b079bbaa02d420ed719ae2f2bfc435a9b9f49626bc3ea2bd85
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 8d2a2376441644356bffe1961ae1a61ae689738297e4a6ea53da0c4b6ae5a8ad
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 b851329cdbbb4d9db2e5eb88730514341191aaf420defb9c96c3ae90c6f2d7ed
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 c0fe99adea90a9819d5de62913bb0c24762c5db5ef27d504861aa52bf2a0a397
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 181973ba044882db127e527287d3930bb4c79be53e16fc917a54c54c15c7e0eb
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 3e75902e79388915ec9d8d17c3ca7ab95af16de62c57ee5c2fcea07c215672a6
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 8de83a6c2420ef5a4a9be38cc635d7443e7739642bd9fb048c8bb460efe04cb8
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 e6fad13ccaf97b42705b7c907ef888d40ad6f14632801eba30e5cdf950c75f98
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 59a47b612078398dc2acc8fc78e0066de304616729c023a32fbead78e8d664f8
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 d0903e8689566e85235fbcf1d8f6ec388d2a7d5872cf53f7b76e26179502627a
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 1496817f7e4112c643fab411d6b8eb729db44ddfb329b01cb4804f6d2c7c83f5
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 2b66f1e23f9d863a14156f95fa2d21b75e9f4064ac21f90d60468ec663326dda
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 4a8ef18ce72e06f40b1055a497ecef69884025f4efd41631d0296f629baa9e5f
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 841f4eb44fb8c95c12c6f09bb964f7c3cd5c7c2954b3412d7da85b5ac97ba9b4
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 a205c90a54bc2fa6cf84936a1c7e50b2f914b46e1f244dacd8e77b7f4a510c23
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 e9a6fcde2c70fabb07af9e3fd163111581f6d68aa68744c19d169aba41dbd96c
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 c28e74ea3c8769680f8f899aaaaf8620453c9af9a6089e880ca9b152ad25be38
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 49ccaa3a59183bbc8b325489bd3d8c9d29358dc287e925e2880bf12f027f0f55
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 ad1f640cf00a361d13569f3ddd5fb16537b2623e82fed3458a2c9b4573282220
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 c4edcacb5becd5baa8057b1ea0de1bbb37ec904be685f172d63789def61a3410
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 27a7ee49cc45c2866debf576c5104cecbba1f62aecd3bef34a0400591d6751a7
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 f616df0a37f7a8df1b2aaa7b157b578149c59797f994ceb4bf42a6edd67430a3
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 56256b2bc2d0603de3af41c07414d73c31f682d3a1270b85a593f61d759cd0d3
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 d3010cd5854831dbc0b84d317abaae873f5e1f0e3c736bff9c67abfb7dc820c6
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 afe3bc3b0d594a9389d3b117ca389ba17a5bef4ab7053fc9e9fa5d7f6ed6526c
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 fa668773d17874884787cb6a3085d528c210dbf5e0a4b08456d70907f0ff29ed
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 a9b2b5291b05d4c6da452e3f61f8c06b67faf668cf830d46d2f3ba58c99fdc91
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 58cab098e9998b4b95eeeadd3a60b61167be9490068a08e04d60e9deee245de5
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 eb1f02ea01eae268540223f2271505a4535f6371027d97ec14547e2fcf0e8cd4
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 09e6d745f68d5536ff7a07756d83fe1affa8a156f5150501bdba3c7611d08e8b
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 671dc047a501aae5a7a57528d3c3efd91d77ff5b0551a41667e5d58bcd071ab8
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 3342914634d556d0de7a0adb892e756589ce99124bbdd9fedb89f3976ce74090
          • MD5 SHA1 SHA512

          Admin7

          • Path C:\Users\Admin\AppData\Local\Temp\Admin7
          • Size 8B
          • SHA256 392804dc607048ff7020d8370ad11c93252814c5b214f61d6ef110815650e9e1
          • MD5 SHA1 SHA512

          Admin8

          • Path C:\Users\Admin\AppData\Local\Temp\Admin8
          • Size 8B
          • SHA256 1c41e26ad0e154bc7ad23776dd67ab7aba3e540134136232cd84f986303974f6
          • MD5 SHA1 SHA512

          Adminlog.dat

          • Path C:\Users\Admin\AppData\Roaming\Adminlog.dat
          • Size 15B
          • SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
          • MD5 SHA1 SHA512

          server.exe

          • Path C:\directory\CyberGate\install\server.exe
          • Size 1.1MB
          • SHA256 b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
          • MD5 SHA1 SHA512 SSDEEP

          memory/380-0-0x00000000745F2000-0x00000000745F3000-memory.dmp

          memory/380-8-0x00000000745F0000-0x0000000074BA1000-memory.dmp

          memory/380-1-0x00000000745F0000-0x0000000074BA1000-memory.dmp

          memory/380-2-0x00000000745F0000-0x0000000074BA1000-memory.dmp

          memory/1804-16-0x00000000001F0000-0x00000000001F1000-memory.dmp

          memory/1804-17-0x0000000000690000-0x0000000000691000-memory.dmp

          memory/1804-32-0x0000000000400000-0x000000000051F000-memory.dmp

          memory/3596-4-0x0000000000400000-0x0000000000450000-memory.dmp

          memory/3596-3-0x0000000000400000-0x0000000000450000-memory.dmp

          memory/3596-5-0x0000000000400000-0x0000000000450000-memory.dmp

          memory/3596-15-0x0000000010480000-0x00000000104E5000-memory.dmp

          memory/3596-7-0x0000000000400000-0x0000000000450000-memory.dmp

          memory/3596-12-0x0000000010410000-0x0000000010475000-memory.dmp

          memory/3596-73-0x0000000010480000-0x00000000104E5000-memory.dmp

          memory/3596-80-0x0000000000400000-0x0000000000450000-memory.dmp