Analysis

  • max time kernel
    150s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/08/2024, 13:09

General

  • Target
    9a2891cc50ec094daa4444c764d247ac_JaffaCakes118.exe
  • Size 283KB
  • Sample240815-qds5kaxern
  • SHA256 638b89ea298642cb745d403ad985e3b6a68c3c0b9e5ff1fdc68c89c714266a66
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • spybob.dyndns-ip.com:999

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    spynet

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    tribaleagle

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 8 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9a2891cc50ec094daa4444c764d247ac_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\9a2891cc50ec094daa4444c764d247ac_JaffaCakes118.exe"
    1⤵
    • Adds policy Run key to start application
    • Boot or Logon Autostart Execution: Active Setup
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:316
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      2⤵
        PID:3464
      • C:\Users\Admin\AppData\Local\Temp\9a2891cc50ec094daa4444c764d247ac_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\9a2891cc50ec094daa4444c764d247ac_JaffaCakes118.exe"
        2⤵
        • Checks computer location settings
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        PID:4160
        • C:\Windows\SysWOW64\spynet\server.exe
          "C:\Windows\system32\spynet\server.exe"
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Executes dropped EXE
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:2180
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            4⤵
              PID:324
            • C:\Windows\SysWOW64\spynet\server.exe
              "C:\Windows\SysWOW64\spynet\server.exe"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:1724

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 711b8e27f3d2d947419071c60f7d90bbfb5f67952bbd6d2b7b4d5ed5a7933a37
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 229KB
            • SHA256 7dfd3efaea5034b259fd5c30913869f81df2962553df4c6a046c584521779ba4
            • MD5 SHA1 SHA512 SSDEEP

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 229KB
            • SHA256 50dc08808e0ac23a30d068d565db16df5442eecbbeae0b4ab933ee9ea6558b2f
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c38c9e42573b875e96dd7c2e11fdaefa5d6e4070dba5470c3fab7f5c4841f5a0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4605a6adfa406684d588ca6273a85cfd2e19aa74d62afd38045ba0d420c521e0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 01efc65ffb0362e367e3a74ce097e6c8e8e61ff0c1c6d06bc608d3c9ab45d9a8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6314b3edb4ab8a6431f2529adcc57f829ec255523f9dce4dae9d3d662d2bcf29
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e1f44ce839ea9567c3756b4a53682dd3f5a9db605423b7bfbfddbc617cfb7a84
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a2b10ac3939d4530a90604766aaa15c629e1afe5cebe99be504cce5c75f1658f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 02161f62811ef4ab0795fde61059f1fa6eff0053448cef2a17da87a8d5062ec5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a68a4f38fb96f7e436ebf42ee43db1a819e28b2d2d2151c5b1585f39ec386100
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 af63dd2e03846b1ec421843523b726ea4d1f4b724a37423c7072f7eb43b9203e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fe8c35aedf981d8e63d9a01ba762ca1ee8e19df5169c9d3728039a277cf600f9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 40c4a166ecdb1d4b70ef96664d85c883ec6c2ea3421d76db0deec063fc5b32ea
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3abdd2eec1ce34b078604ab686415d720d7ca7ddd797e66bc3d211fd0f6806cc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8c797f3672558553a2f02049bf8b4038e7e0de0102ce8f64fd5f87be890067ff
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 28dafc83be9fa2560a6e0835054be59ff8beafdbadcf211736b0f04f3335d28e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f690659c256f15fff36c40a906274f2e5b8094a2fbcce0a55c9d1467a37724b1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 77309100083ca69754e8775b2c905b5cfacc8db29ef944afede1b2b4bc1f0050
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 10e21004ad7a9ba1f576340e638565c3e16eeacaf901c982c1e812ad7469a368
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6d941eba1c923568dc9026ac4aef524ebc51e71a040f5b72dbbaab80d205bcb2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ed72f443f0885b966b8a252a75834dd8d19d0484c253bc9eea5d7e6695647d0a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e391ec2a2c07bbab0e980134a80514a112a8339c577c56f450eabea493d316a2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3dc57169d5bf18e3c2943b463a0431909161861ad6ad97b66795f53cd025e025
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 19f3136f86c00dcd7431ba21025ced641aa9ccd5c33e53dfa43074dd5cd3e449
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1a1d5638c59d5eba5212ba6af522ed872822bb79b4bafe4ebf0f00fa47399e8b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 21285ee31b3cebaf23c1775fdfbc33bb30d7d77954f6c04237c5a9e4a815a50b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9ff9726d54b73870f9bf5a656f4bda6cabe81362c36d3d2ba61f7f021f6f0c9a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0f574f3f5ef25cc4edd8163af2f395ec54c488d53e192d3ddfb3783f3fb56ee5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a55fcb22c3dd6e4e9310e9890a81604b0939f732092c9285be76a68a8d94ee1b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0862b8084f5d52fe08a400dfa782d0045bb7489464799ebf297f84b52a1d4c9b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 95fb326ab9ad7b03f190870b72cb4092fe9b6f55b6049b13fd0826759e3c19bf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eb65914e509d80dcc8d012a477ed6be0adf43b0229678de3808ba51b0f162210
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1d1f415108ed97f9331cadddc430aac9dba4ad165fde657bc618b579a880eebe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f8679ebc571c00afc779e8e92a06b2712c9f45bfd6a87eced66bd77dd2fbd334
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 06bab694781c7d8fd67db79ba734bc9f0fea06f698cdba41fa7c40af38309ec5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 707380c6ec410e4504c8a7314bc7d214fb97780cc38f5503c0f5a15c081747a2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bee91c16869abc0d3e07a7721fb6e7225854d78b9e0c55649ed697a4fde0c553
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9551e23a838ad739c079c442706052b7173d42f71a734c036947e07d79c34a05
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e2941bae5394ba936519432c41fc13de2e3e272f6c6af66ccc291252f5ad5b74
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8fe72c362ce5716d426d6e5cfbac9ece3014d79dbcbc9ba301ce3bb6fce2888e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 586f36b33de76804c6cf2386c9cc6843c2af6b28944948c13f85a00d44a28dc7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4426ac4b0eb6927d978ae69be5c91405906e2a853bfbb47f9e0901f82c6e9b50
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 13870d200cb6a898efab7a2ae6b435a7c660cda89b475346cdc70a49aa33ec79
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2c8cce53ac9aee34dcf7b4c83b49e9581c95f7b8608ed7f590ffa4419b316d18
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f8d6c7e2683faf541d294c1e9d0bad8f3d3582fd87985ee6bfd37962814a9692
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a8011f558b6981b5eeb993701a16aaf1c615f60f6fda8482c1981059b60307c4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7ee541bc16ebef6bc5f41855225cf2731a24a252e5ea2b9306196359c5cdbf41
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 94e2de576652521c1314e71dd24f457587a2539d884bc2855a840373c070374f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d673b5960dc0a1e756c4d4a817bd494bb586c53fbc66578ed603abb5e8d7aa6c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5072d90d3779e9e774b22cbf0d7f41ee77fbe41f10a9a76315c9f6ee9719f6a5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 57f3fabfa97f7ddf606443e9fbb0ac7de51d4cb0c8bd51007a92d2f6b5820ac7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4706655e575a8c64e2a4c0441223bf5af85eead587a81ba40096ace60c52eda6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 328eed2f283bb8bc21532ea95080a6d8ea19ca22b3e18c6914960d4dfc75d607
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b960c75368290cd1c61a461298111c5fa099c4461a0c4e57c802fd26f53ba3de
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2067d40e713e99052d961d7ded8d25d496e144dd12c5599aa9aab50d1a726986
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2ff0e3a39c69ccf379871ce163778953a74b679861356c350029a5963f07228c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c0050bdf8e9be9228be12b2b8d172d651d2eb276bada7351b35fa1a28fb862dc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cd50745ce37f7c7af00ab641586d2cda5375c11d21ea68cd62eae7a029209689
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f6fa9d5c5a686f6a4a53bf03de4f6a44ec653b9d654d10b04a2620395ca8996e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9f3360479680e9b4b051f79a4507ef34cd1796637629382a4c717c2c36e21df2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9263f9c6de37050c8323c0bca2cae9bcb3a197dc2356786bfa47c14d761f69b7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 028ec234d81e5494561dcaf889a20fd109c33a89256b99b7ccb89ae839ea1318
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 470744b4ece46dcf730132dcacd3bf082c81d0a79c10deb6fdb1e1aa2b46b178
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3dc1ac6ea9ed7df8e6c13c9aef513fbd37e927e1d5e60e3f699409bbb23f5fce
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bce71da9a2d8cfb6d0f59a32da34745304a59a2ddb7cd0276c2ead31ff815800
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6945704ad6bfbaea973479cdfe98094d0f0bf5ad51c3f14b9df55709393a3320
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b28b5e0ae4789b4b0991fd2a979d4830dca58fae1f66cb49d9e79df85b2657fe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dd4489d97ca9d4520022fff723bf3166795bc82a745e940b96e651b8515a1c66
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0717add67d40a32c62c995cc0d2a01d56ba21389ac6b3f2810beab3e3487df73
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 63a6178b26c98a59bc6e81e9f53500f4eda6096e86ac0b281c5c2871de255a19
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 57fc79c8f04b7898ad15a5257cceab9a9dcd94d93670f6e3569eb1e1f0c28bc9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0966269e9fe01b738fc08db3395ff8211618e5ce071cb3134f473476f83c7605
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 955f35399e7f02232c63daefaad5b4a787e74a3dfde9699af1e43f6204a7dd51
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 491972867c2dc9b99f6777744f93a90e7353dbb2514d1e03ff2468c4448e6825
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 47798c5c1bbde194d5c61b6ad186cb525c75bd0a23a656598269724d8f3bd717
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5c1c5572740a9d9e6fda3ed8925ef71d5499706585b92180bd50c61f78f7600d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a50714cbec4e4795b86e47ed2135dfc9904b5109dd9edfedf3e84333b9727f51
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 beb50b3aca591d79372dfda9335344ae2bdb743ce7efcf92750d46741a549473
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c5dd3463c29a8157cf08803799f0abb654d39bea1da9b4a6ed6ae63b5e8b8c03
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 47f355a2ae25ff171288765593c5c75d3e4cdde5e092f7afda37fbb624758669
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a0afb44163a931fafdb54c89f1a61bea8a537f9383a455a8bf92c8b401dd3067
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8f68a42953dd5ff022ad958301a0b91973a50ab986b0402acf258a82a9b554c4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0f4ad03b6152e408de6f1debb2b78f4d39ff00b0f16f647dbb709d3832c6ce35
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e5f4161b2462224df6ad4a6317024e8cf616e6c6571d76fa8ea923919bb83816
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7fb3b38e8fc9047970066bbb6dfac47263aefbf8d60df4bec8775cf6dd65ba7c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0a00743a062f22fb25f4531ec7c8fbc821b0d0b34a4e7dc5236cfd0dae011bfb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7d2c892e47d3db99943ebf4d2dea9a47e6cddb4807b23387bc997bb776384c7b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 57e96d2590813d1c51e5b1ea81b5c3ace79df71d66ca96ffc6616273e7483acd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 36508f19f9a718f601af868379e937706d539de2a6ec03b2f8f7dce4956fdb06
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d11727570e0e632e31e34eed7221e322766818da3848c2b775f86939374b4c95
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f34bf6d83e5125336e14a5fa665832b59e5678459d4ce8ce4a548c27de897fc6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ab9b38b353fe1381ab1c8b1c23a4ccd7698388afb7bfde85b3bf6d3d27d48886
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1bce99c48e6fea39ea42629f87c9a8953078c44332570622e5249d3133d9bb3b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 283f5348bf517acb32afab153a98a266c4cfc9b3d909a3f0bbfd05215175bc69
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2aa16ad02eac25f620f3c966f708f604e58d1f8d79c254797150373b1fea7e2f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 adeba6b3474172ef5be2350f7b57c7d336b43de1f90096a602f1a157b7770635
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1b838bf8266cc5ac1aee7da6aed8b0e1e09fae4816211716f6df2b089203747d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 885d1a3b94a9040df108bad46da2c8ebe2037058d3076a70eb74d7dfe55f60fc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 440a55c500082e573225da6831614e249f5326eec9540746eea3ad886d16c4af
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8dc6510f7014d76478110a14627088ede920678c3565173511248d289e99f2c3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 235fcaaa8e71afcf27fc687c7f139095bd62a74493089e5bda0a4ba8f92372ea
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d730a87ffcd0572965cca8538de2f5be161c9d0d26e6a0193459e32d404bad2f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6b9e4f93b170160a390e51196bdf8207086501ed1cae3c665b212048fd3680e6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7877e99efdf2d5f1b80ad7db1aa9620a0a32c2173cff70ffed673f747f9425ed
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ba62da80aaef3abe3b3c9e277b11d90469197c4139a2b1f02b96d7798fd5d670
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a358fb296531aefcba309ca7392329e96765f3240ca4a5a01d18b2440e5671ef
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d4fe1b9a9064c23faeae59c6e774bd39cbf3820a40c1e5808386c1ad9f9056fe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bbaa8339187835d150d73ea35933a7c7141a3f05a7c1b2f5f227febe20640283
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0ad04e7a629160f89b3f2408bbf7ab0277feb961cefe0d6ff14d0fac8041c3f8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 43f8918b91e8998c5379fd0b4d1fa323f6bf0bb7609ee40ffe842b1ce032422c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2fa49154dbeca204e359abe2fd85e7c8bd34b43e8c48468cbd252aa92b5692b2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 59489250ef14840c0b154d6ad27dcb5a2828003850e29521d3d26b4c0ce673b6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 94d49756955d9270553d7195161599f67031a3a2524ea830a63b606e9344ee4c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5b4612ab91fbbb9f13539862a3552b3b6ea482aed276fca90d40424edcc84811
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8b706da424e911a9044ba30b60b7f22b951e8afadf5011cccbbeb19e136e882a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 71e88691614d12a6e17f6b2bba29d9277fa74082e6ab920414ea89bf1d350ce2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5037b89dd7c066d61e34ff6173df8d02f333845ba2c02c27f2da0b7275d17d36
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 18bd3c22ffcd83e0c68b970df1dab98c6d8aca2e23006777cecf6a0faeb38fb9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 615dca4ebe083f807d391be34b63a994cad8da47a732dfbcbe647c97a39802b6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0041fc34864914ab4917e73cc39fc3410298743b5b4e75995cc836dfeebef1bd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 be067fd966d2b86098b7d90956cfc1eb84df67d1192043c7cdff6829b268397d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6ed260ea6a1ab10890ba8b28c5244b1f1271087396370c09a198f5b1c84461a3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3c797fd10ae13a06c0690a52e855d23e708fccaa604f639e1765a7429b38e874
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 09df0a859c875ea02b6e7b77f81e4d5c12907dbc64e63ba7ee9b5bf013112b5d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0b24f7566662522c0feb2a538fd2afff743baed304a6c14e66b84131264839c3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b95cab2932a243eeb0f1ce96cd3d392d7513a288e3d0718d7567b26687ee7597
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c7a66cd8cabba4e3813aaad03e16f707e3634c34f0b857b8fefdfef258c7fed2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fb54673e48961f410b15a0359d271f8ec4eea9419a84a7f1f8c7061e2b7cf181
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 36d6e0c5412f5787374c4220bcd3e9557d38a0dc7241d3722a75a48f6d8eb79e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0ece5fcee8946a9a99765055713e0801f0c5b06f0c944a63d62d0eb33f78d418
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f2b7133f1c63d5779f722019ca6b082bfa4ea8249dcf088efa26b484b29c9947
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 865a7fb54cee1f270dca0df41071f21eeeeab4f9e374bc21a3de81aad7204fe6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c5a166e972bee5dee8cd91f2a9a7b885965dd7261c6eb939b6bb74a46f4fad85
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f5dc37e648939c1d913db569d85a4fa9650fabb7adc6f99ee7b86a7a35faa219
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fc1002a3411fb4950819592422cf96f7412652fc2163b838c30a02d3102d8f77
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8a8e93ecc51482f4f3841e5fba0409d73716a099d5c43edc4b5069caf2a37866
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3ad340974b5f42cc0a3db4862d646bdc80fbb78f379d5c13d2dbb3d5a488d1bd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 274ad0f5b4394e5a20e8e66d6b04ba3ca4bb411392e969edc4ff0a2ef36475f8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 41527b9d1dc9210e4f3cb11ecdc11cb492daf57c6332638d1cb08118ad89dcab
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2ee2c39865d322fdcfcb79febe4be0dde1d5e1e8e04e3f6e695b4677d36f4c2f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ceeef1a8fac56d0ffca99eea8b98a835933d6b67e3a2da4442e51764f8419a0f
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
            • MD5 SHA1 SHA512

            server.exe

            • Path C:\Windows\SysWOW64\spynet\server.exe
            • Size 283KB
            • SHA256 638b89ea298642cb745d403ad985e3b6a68c3c0b9e5ff1fdc68c89c714266a66
            • MD5 SHA1 SHA512 SSDEEP

            memory/316-6-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/316-3-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/316-63-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/1724-184-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/1724-163-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/4160-68-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/4160-66-0x0000000003CA0000-0x0000000003CA1000-memory.dmp

            memory/4160-117-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/4160-7-0x00000000001E0000-0x00000000001E1000-memory.dmp

            memory/4160-8-0x00000000005B0000-0x00000000005B1000-memory.dmp