Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/07/2024, 00:15

General

  • Target
    3290a22a51098bd6ec425a0193eacc1e_JaffaCakes118.exe
  • Size 1.2MB
  • Sample240710-ajv84swflb
  • SHA256 5842144b69dd8c40941994d50fb0a7c2a5041659073a51a29fbbb44ed0ed1230
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • your_dns_here:81

  • 127.0.0.1:82

Mutex
  • ***mkju***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    spynet

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • ASPack v2.12-2.42 1 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3424
      • C:\Users\Admin\AppData\Local\Temp\3290a22a51098bd6ec425a0193eacc1e_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\3290a22a51098bd6ec425a0193eacc1e_JaffaCakes118.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4612
        • C:\Users\Admin\AppData\Local\Temp\3290a22a51098bd6ec425a0193eacc1e_JaffaCakes118.exe
          C:\Users\Admin\AppData\Local\Temp\3290a22a51098bd6ec425a0193eacc1e_JaffaCakes118.exe
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Adds Run key to start application
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:3560
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Boot or Logon Autostart Execution: Active Setup
            PID:3912
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            4⤵
              PID:4620
            • C:\Users\Admin\AppData\Local\Temp\3290a22a51098bd6ec425a0193eacc1e_JaffaCakes118.exe
              "C:\Users\Admin\AppData\Local\Temp\3290a22a51098bd6ec425a0193eacc1e_JaffaCakes118.exe"
              4⤵
              • Checks computer location settings
              • Drops file in System32 directory
              • Modifies registry class
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of AdjustPrivilegeToken
              PID:2808
              • C:\Windows\SysWOW64\spynet\server.exe
                "C:\Windows\system32\spynet\server.exe"
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of SetWindowsHookEx
                PID:1052
                • C:\Windows\SysWOW64\spynet\server.exe
                  C:\Windows\SysWOW64\spynet\server.exe
                  6⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2288

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 830d0fbc495bbec3e24d4c9f74710e866e98e6a16b901664b4f43db72065c69c
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 229KB
            • SHA256 9f989f732845d9d52c3b4200f708aed64b662132808ea5ab7b6fae5ff52aed33
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 53497c52a7525360dc7e86e6263c6fa5653541009ef96fae534386d8112db289
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d034b6cbf41e62094cc9eae20f58000e9d4af0a2e4ea3b3cf8e51f00ba27d413
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 359aded344dd4d7f43010d5da05b1cacd6d4dcc49233098d5e2b9f9b3455f65f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 38ab16927b5b7c1c7b83f9390c0e55917e36126ffe247313ef21d7985e27e8b4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c4a95695dec0001e98c5da0c86590a6b432140c1453bb533c556e7d4455898f6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 82056812637fe722f4989051981acfe7cb3b94009cf35cea9f3ad9b91c775257
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2bbc2d1b74aacbcc5ab1434a247b47ef1bed435008abb412bfdfc11bfff6c329
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cd183e9936482e61e4b89ef84dbe32da43b59e97fb31a7d83f7d786a65a61bfa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 799e6da14fa7e4158c382470bb539112c39041b0fe991cecd571796304b5c892
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c6bc1046c21c895a749697f2b185c4fede04e07a9938685fb443a814aa6b80d2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 84c4cdb141905bd5bbc6b3fe4fecfcff1ea3ecfc2c52c4ebaf21bfb99d9b6d29
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f229f236a98ec79891b8c4dff383ae0a5f0dbfb189a90e773dd1392c9ebdae41
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ca58c370bf3283054f896e62880528bde2bd1c780988eaefff4896ee09a68c9c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1fc2be0ef0bb273a3fa51ccd5e1776c06c1c5917e97bb973bd58d4bb5974a2cd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f47da5d483de44ac950244dd586bfc35195c7bb4e69cf693a406ca5d4af6ac08
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 96e546d54ce16847c1db80ea8e0ea6eac420f2fee6e1a1faeb4beda548de82b7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c6a200224e20116c5d9ccf065dd152d03badbeff1d2858f5eaa202063d1ee2df
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f6502ce62263a546ed8dc934467f668a864b310295984eb804d2a3afbba11968
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 05f5aa2f3467bf8f576c8f6069e97b5359c9e899abffc4e765988af222a0db0b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b398f87d9cd2945399fb1ec08ac79328ace1e0afc2bf0012659d42cd4ea90884
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 66d4e4d61748a9e7d1e942b6e61545c3b48bad2e1ba0233ec9fc8273ef82b837
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b0345867194025966ec7fcd236b3a59ff97b747cb67cac7e015165ce632dc321
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 be1fb2da9d481fdd3119ab712550955a979e62ae7c75c75732cc8a1a53560edf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e8ba8c10954a51e1b9f9bdd244787244cc6596507a0f3a1b4b548a96b22b8e12
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f4bd301d05632e49559d490f37d271105545d80ffbf40961c91c94970f2bf33e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e1286b8c0bd844d1a1f5f89451bf8701dcdaa39121f2c9c9ba42078b6fa682e0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 76aba9c7562df62ef29b5164bbdcb08ebb41cadb6fbc2207ec404c31eb7c1146
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 29128beca96b215263e0bcd13cf71c4dd9b7e569e290cf04086839e647b0d3a3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3496d3a2d527e3f40dfaf29ad60e54ba4a767ea6b635090c42f189cc2ec72006
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 51e5e30e6b3203e89341eb4f07b22c58af719437dfd077bf98d6481b27711a50
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0539f2184fdc67a02027c050a1d4f5d35ff37b1312b6023ed5f0877f8ad9ac90
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4031a5431bd0d9fabd38959f2128b2cde70c329b8ab53d1d5fbf531809a636d5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ae82a58a24d033d81470e7809c2ed44bac5ca9e2ac6469623b80c283279bc6b9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7e30f8d13525c5d4e23daaabbc106bdd78690e1083dcf072a9c6b53fd0f0483b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0a73dc5f989bf8650653bd21a54c8439f84d78fa7062e22dabcf183eeab52d33
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0951e25abd7350540546a058b81b1ef90f9ab65f02f2e6db5736b02ceeed4c0d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 181215eede92dbd959a250bee63f92afc93a3886d0873fc978d8ab3ca48ef7ce
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5cdeb8654ce69ea80b2a5ae68248f35848bf20b86809e49bd4241edc3858a00b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 db3b7974187aa8a7bc2f29d6907d271b1ca538265e266cc4bc5d5dd9d9a42635
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 208d316b92f73e84aeea323b2fb9fd034b6bc736cf7f77ee11721283c56a7cbc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c87ef6a42c5518de98ac0164b6c3883803e7cd733ff0e12e2de38bda24d9edae
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 582c1f7f8a149fa3025580b35a518474cc1a5c8f033f37cb20d97670e0ec57b1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 60bc31b7deaf495090cc718005bd1f4983dfdd8caa9f819e8720ca5d71e5dd24
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 85eb44c6bf626365caabf6f93d0e02c2c0153d2a204fe0a21bbdb502341727b8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e3ad72b0a3d044e61b88ccb2d27336ae9c91a7e10093af8714540ed55d6248ca
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5930fa738a517e834fe8aaae179d27276736d37e88acd1d8462f0d8429277ce5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f284feb416c21110927af1972084609534198a3d2c5f6f31287697cb81e3e98b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 10d616ec77d624edb15913391f1961ee1ff5f2726b1c02343763226c9e56b27e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1563777a23ece316c5a14ba577f665ca7b96efb5220fa3df82da8637f98f53fb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6382f50c893bf3d40519650a067d8fbd42f61886a96ac329814e2e39fe0defd2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 36bf3ef8f522465293b146c59707a485171109a2447eccfda1a71b5e97abb62a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7f4b2d16a6a2eacd5eaf46621c11a6d53af2af00485e2e5d191e1d3c66aa9c84
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 90866b90dfa67be67293700fedb1dc75cf269ecfa29c4175054676a7857212e6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 45a31b1aeb2d5b6eeb8c3d92cc5234979e75e5c13b347ae59e358b09a1671860
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 156092dff7798ffd173792dfbbcf276c0ab5cd77fb0443d4fe1776c2bd28cd7c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 03da864e304cc6f3dfd29b282e933cb571da244519406a6b06fb40fd92192187
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9ef195921f7b1914b60ed3477431c1a667a5670164d702fcf94a0bbc7fb03835
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 372f50e84285f10b86b77660728cde6fdeaa79263b4a1532dd9a9db20b84df70
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ba87e53d5a2beedf8328e9cb9d7bad011c1b1612b6c826869edaa2345adc15d7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bd4b389e40c6ac1a67acf097b86fa3403f52caae47365bba9afdef5561e4f034
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a23fbbe45727cad8c94bc61574586fa3815beb5510e9987265c38dc871e1868e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 74f58ed05d6fd4ba29c138ff293cdf4547dbd9197dd136627a2e16898f0914e9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5f3155de0ca310be1f88e668c98ee9f4e9e366c006e00fb7962a6dbe31051d70
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 87fdff271e14163fb55d77daa6a5f5260eef88336010aea70e250c7cd078442a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a40afd876ecbbaf8098276c6c9d983ed9c12d27c0b8ceac1c67a72b2facfe81e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a6a089e095a679a4ca28f0636d74725ac4cbbed3bd2fa496f3c6f7daf7b68953
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fba0bfbdcf5074c97762c254fb6a9ebc206fafc5e858f7f516c62814ab007f55
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1c03ada3dd09eadc7009949f29ea6cad9c1c918c7d2214b116af40d2d05f2391
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f54bf1d9d91343401213bf2a5c79b727ed631c388c642913f9a39bb61af6984c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1732299b52681e0912ec3f84f6fc49a4382f8a39bde68340916d20a8934b1696
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 395049cf77eb8f96c95da920c98c27a3c708afe2b8ae883e1bed3dd07bcf7cc2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0d9642d124d966cf48598c4d0daa9183ce5ff75ab45de24b047c58b224d8df1d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 40ca4bdae6ccc350947cca7397741ba237f16c98f331cab4f2c33be429b7e5ad
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 99802e2c59c340d3026be670235a9d536ce184f6938ed3e28d21a2ca2e2ed9d9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aad88f481ac25526346a86fd5561e1ac6db8433ba2acf14f1fdae9b6049d804f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 131bd13eaeff3a3b9ac66c1480bc2a67865ab36c5606a50876008e5cfa46e7ad
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3785db910025ffab81fd45f9aa985fdbc3e09f12b2e493a86dec6976ec32129c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c7c885bf14aaeffda10c39d28b25b59d38dbec5d39c526ffffe52221bed3134d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 918f73bd87faa90afb3751c79da3e9a766af6127651d0e0ab35523b0187591f4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6b8aaf64e550974e113e0b7709e226cfdd7f3ac27ba9672c02cdc29bccfe8b00
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a9d2fad431ed115f51d49fd681b27fce7ddd367cde20e030505c2d8a61892c74
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6cf66157b48554b46709883ccdc2390d4f898940b8dd7704e93457b74ca238cd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 90e490ad7bc31ee965f11daebbdbcf93a2663110e483070aedbe7ad5d3e7ab14
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 02a28c5a65ac1b94c7838f3dc916fae29d0a7f27ba214cd18c472ffe18dd3687
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 af2269f3d4d260911ed5f95a140ce56a2f51c0ea6e5a662a9cb90f32b790fdaf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6aa436ae9fc7965a032993ac19541d39c0bdecefdad9152b0ec39a59add4377f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8f079e5fa16510dda3a84846164d4e1c670e11fb35a8fa4fd2c8a07a9fedbf41
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e95e0cc425f6cdc486a8b895145c1d2b031d2b711de2130e34311b6451a4b16f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e0135d2be9851c6c3cd8805d0eaac1ecf10d373d59753bd5be231b709982cadc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4ffbed2971307215626c7b9bc40f3bf7205cbb28922bf0baf93cadb135e13a13
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 179a8abc6be8cbe0080195b623111bebbd55746f04b1453e263e0bfc4d62fbab
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 89196920d1ec18a167f78fcd4e344805f1370f2bb101b17e379aa1b98f1dce9a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0f023f06658937073147947cbc203401806e07ab57aedf7b2f22efd9ed66b703
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 567b97cf085b93b3f450def441db89961e2921ac8a7d3738fded3b0860f02b3c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bf2231d092af7a2c9e6835ee39dfae80f870d50c7cd133fd1defbeb546583d12
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0d9aabb0fb6257da3ee8a0efed40c8bb4b3caa184e71bd291950ab16e4e6faf9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a97afe31e819f74e8ffcba9022420f58ef67e4eecf15968c15aa6e1ea23a5609
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ea4a11ef7962ade6f891ec9705cc82bc939e3808ca204713488978d7455ab593
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d7c63180a5431693117e3760ce4ddd27daa2887afbf827c1c7e58ecd0473b54e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7d23f50f7cf9d91c0df05559b30ed605e446f5312decc987b36fef6b2ee2cf08
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e231ffa121e5deaf9160b8537df6b285f4e700d7ed67c6509ebbaaf43933f85c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 802473660df52cc64b5492af366341392ca31e59e965f0f8d48f503996649787
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7174278b4db1ba2ece29ffcc8ee9a7bc7fd2d68a679cd37bed3bbc9f813b591b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e8c5b4b3a2ec10df9c5fc55f01698b1ba94025b511100a4c85a8071748eac52c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dbd0c990e6f2fffac230c9c994186142f1300ce7927225e43e96cfce71e691ff
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 69ebe6220c351fd19aaf47b0e8d4e520e59428055cca023a13742de8b3a564ab
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 51a5c19b28d92654153d6e47970d22ec1eead7b54804e9ada2e5f7d42bd9c81a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 112907de57db1e255736c67f053baa440b9ae8d75d761e34976b332cc9be8294
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1d7731eb2917c098b10ab03a6ff7ca189b61c1e895425e6231f8552d65d57380
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7d132d14c36796b8ff8532f9da7419ac2394a0eaadaed8a6acaedaa541d8b5e8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 315071c27a272c248114c7a65c6170f0ed73c3b876bbdb15d8d0812981f79273
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ed4a841f63f593006a78b027bc6265433a6d8ccf8b9e7e9e5d091d7c8306632a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4d138b6a2ddc3ae8f7dd6787c62a1cd4683f48cbd059a21e6c34baf9f28df1a9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 01d8c670bea00987b1a9fb3ae0da9e44a475766023b16c415ce5722cd3237ab2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c9d173b650657d703358d6d513bd6ab7aaa892fd09a93263d549eb4bc7960a36
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f56532091c45a97865e5087035ee47999c22829f80ed716f24615fe8b49ddcc8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f7098e2b61973c19d50e3457bb65d0e2c7a9354fa616cd16cae8e7a65cf122ee
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dd5c169ae438a455de669d03ae18ed34bb9c5969532ae238e6e6fe8dbb1c6dae
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2f929e97e2721e2fc05e5a4301ac8edb2cb85159d8c493f8d1e03490eaf5d74c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 24cdc1ee814dc70e20dd5c91617391ee657b2da9ee9416a556309a176ca2618a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bef92b1fb6a98209f1b28363f2a9a32f559bcf3a8e9ba03e25091a6b39dfd1fa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 738953d366db1cb4829c31fe6871503e8f2d29b06ae74153204d49e174b11986
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 75557074ca4d0d660bdd38ee7325c8a3db54a25c501eb0bb325d8cf92cbe1704
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3fe51ea44c06e0094776b9f431d44ccbdae518e0ee689885dde03dc01cafb0de
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 647914db0eaa630ab72578d324ed38d356f71b32f2aad05e96802d9446605810
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b619215b5f65cb151362bac4e4e37bbabe848dbc73c5983397fec06970914176
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4cb971ce3b48bac96ed789a1e5836f7d372ac028a91a9dae79906b17fd4886dd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4df72e522111048db2bfbb71e7f4640e371c6d3b955232bf2ff42c388d15dd30
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6e23bad6bfcbe0bdbd5a588f1b3864a4aa3eecc92a74e1f19271dc16597608c8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5456fc05982c678f6ad78b0d2f9fac930d36e400936babf1bb63954b32331a31
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 986037eac006f2528a920f459e1c00c08f09093fece2e365117b1456b8bc6a9c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cc3d6ec6183cf61671959d5621721524fdf082e34ace45f217913965d2d9c375
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 479fa10c89ce969125d4359c23562dbab600a8e7269a49b3804a8bc1f99066e4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e6a242e6f112dcc4d56b02be671feeffd4c5bcf506c88776d83b18f09e56d9c5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d396c045095af57d1ba63d2cba0fed8b41ebe9945d6fc2861dfc8fae766b6f3a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4fe4e677c0d37c5a569ff2b76d8a54b5d9f65d0ff5b506bbef83a37f15564edf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c4f91dad4de16a47d21a100f1c272df5f0524d051632d965e10254c27e9f7596
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
            • MD5 SHA1 SHA512

            server.exe

            • Path C:\Windows\SysWOW64\spynet\server.exe
            • Size 1.2MB
            • SHA256 5842144b69dd8c40941994d50fb0a7c2a5041659073a51a29fbbb44ed0ed1230
            • MD5 SHA1 SHA512 SSDEEP

            memory/1052-178-0x0000000000400000-0x0000000000953000-memory.dmp

            memory/2808-1348-0x0000000024160000-0x00000000241C2000-memory.dmp

            memory/2808-150-0x0000000024160000-0x00000000241C2000-memory.dmp

            memory/2808-87-0x0000000000400000-0x0000000000953000-memory.dmp

            memory/3560-149-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/3560-3-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/3560-4-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/3560-6-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/3560-8-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/3560-12-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/3560-15-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/3912-440-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/3912-77-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/3912-17-0x0000000000640000-0x0000000000641000-memory.dmp

            memory/3912-16-0x0000000000380000-0x0000000000381000-memory.dmp

            memory/4612-0-0x0000000000400000-0x0000000000953000-memory.dmp

            memory/4612-7-0x0000000000400000-0x0000000000953000-memory.dmp