Analysis

  • max time kernel
    150s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    16/08/2024, 14:09

General

  • Target
    9eaca335a1d4b1dec6c43d2260521fa8_JaffaCakes118.exe
  • Size 392KB
  • Sample240816-rglqbsseqm
  • SHA256 e8ddcc0a6281b068bb70d83421e9810ebbac24e58cc0185eebd23f5cdb33b325
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • aysemis.no-ip.info:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    spynet

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 5 IoCs
  • UPX packed file 12 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 8 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1228
      • C:\Users\Admin\AppData\Local\Temp\9eaca335a1d4b1dec6c43d2260521fa8_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\9eaca335a1d4b1dec6c43d2260521fa8_JaffaCakes118.exe"
        2⤵
        • Loads dropped DLL
        • Drops file in System32 directory
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2360
        • C:\Users\Admin\AppData\Local\Temp\9eaca335a1d4b1dec6c43d2260521fa8_JaffaCakes118.exe
          C:\Users\Admin\AppData\Local\Temp\9eaca335a1d4b1dec6c43d2260521fa8_JaffaCakes118.exe
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Adds Run key to start application
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:1364
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Boot or Logon Autostart Execution: Active Setup
            • System Location Discovery: System Language Discovery
            PID:1036
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            4⤵
              PID:1072
            • C:\Users\Admin\AppData\Local\Temp\9eaca335a1d4b1dec6c43d2260521fa8_JaffaCakes118.exe
              "C:\Users\Admin\AppData\Local\Temp\9eaca335a1d4b1dec6c43d2260521fa8_JaffaCakes118.exe"
              4⤵
              • Loads dropped DLL
              • Drops file in System32 directory
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of AdjustPrivilegeToken
              PID:2856
              • C:\Windows\SysWOW64\spynet\server.exe
                "C:\Windows\system32\spynet\server.exe"
                5⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Drops file in System32 directory
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:2936
                • C:\Windows\SysWOW64\spynet\server.exe
                  C:\Windows\SysWOW64\spynet\server.exe
                  6⤵
                  • Executes dropped EXE
                  PID:1356

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 229KB
            • SHA256 9287663a59f08c0240789481464c44f59b6856277af148cea20d0753f6b9ab51
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6473ce2cb073d54b74a7d162febb185447f9dab0e6c833046580f87149cc5c49
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1882ee952555a182411b223c9a5260ef232aec774c3096522dcae3be6dd8c5ed
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eab93f5c88c57b1ba098c65634fe41cef5aaa7f077ae88926b6064c27c6d6b19
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1d8601414c2de37795cd85f19c0d93bcb73a1e7bbfc6062664ab55eacad21f06
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 624f412bb24cce467f52263265082b60dde7c88c1a6029d12747bbb7e125bbba
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6440b0101101aae398b830fcce6b54cf06b280cd06503662b5f97fb02084a94a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 247d1d72025e188c329e506f9044f077150a37e48f3f0e2e08d3e7d4673ee263
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f1f95608e5026dc3af8ddfb29b99b7878ee3f3466664140b408a3969998ce5ea
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9eae6e7d4f09998b61413f7dfb1597ca26e6856dbae4833b00ff42ebf0258856
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 52597920945c8a06e57e575089337d5c419ff32b872e3af015a4ecc2a3ed53a8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 81b8fa46a7e423121df5c1e45723de307143d06270db0b5a8d05167a91b18363
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 76ab3b56969273b201f6ad576b7e54e2ef9311d164282597663b8eb33916a8e3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c7b7b1ca926bb9e052577f3e4ed3c537df1e0c9e7e340c9f4683ab042b50dd69
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fb9dd0e48c0ec20c4aeb444b3d5ab01d92347b99e25a54541a88b570dbc5112d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6ec16c58a1f4d7cd4921c303bd4e2b933022f2cb8e3251bc1bad961244b11582
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1dff1a6663b1a1a4a47d47c58e49b5baa306d11e6119664815e6ea32ad0c32fc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b34d4bdec5f910d86c136845f94098b540bc7415e12b50659451fc6078d230d5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 91f4c9e2bea4cb3d80661189ef667273bddb2eef415c0b6d1a5c22b8730cfcc1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 004a2238aa1d7e31b69d6bb9a1ffaabbed0f7cfae278bb1463fe4956046dc28e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a92f6587f6f9018ec3705e1e467bf0c50a81e155cabf49d0a6a4c0b09bd28f69
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 35fc531f6fe3887e4729e5e789896c546598c1165e8a532a5a5ac2d06e9b5eec
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1348fea664d59e09ae6b5f23aef1886409e1d988ca821ebf93981716fb085b58
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c9508393a8db25d7fc9f1d6c7d99cbbfc21360ef9dda4ecba844ac5d40bc0b5e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5310eabaad5c1c412acd46816eed38d30a9b1113517d0da4d8e36c5109aca38a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1c517c354a784d8c14ad772afa91d666dbbd08f24931d31c99637cf5ae1ca687
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 32eef234349b31318f4052585c022780acb595172e18d9b8c9c53b2c55afd724
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 54f7816593125817b218c3b544b15b69c915724aef2a3be10ec1ad71fc180608
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 00a989f196056b14d764b89168ee55fedf125964700cbb4cdc17a032afc4c9d8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5c6360326dfce6af462092d74bae4e1cca26d77ad294860894102a5c50ac8014
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6e0d90df9082d08dc5e48c0cba24f2bef4169bc936ed040913291cfe2b6fa1b5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 db145638c11a61072d1148e3b9d834f88ddba7935e662aa13cee1aa500a2af52
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 562810ac92ea26f30970cf3519b0ed561bb57dd914fd0d53072da1c9f82debcd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 465801b84735b1275eca8a54bfb559abbbac6b2755fca565f49711ddc244f30f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5229ebb0ed2c571a9f04b45bf9ec3e14494e989813c90176ef846a5467fa0f15
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cfa9e52df3bf1957c54ed92a302dd03dd3d9e1201cb3cca8f38a40bb326de479
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 454b493c4ff61942b44e2f8c018c3e9aa711185f0bb167cdfb24ba232f2c62ab
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 50a4ce75dbca86d9e823f67293d878d465c4933698adbe061e448deeab45f7f2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0556bbbef61024205fecfa37e93ddf96010261ea5979c43f755ab5574ff0ea80
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 65dd653129910f4a178d3fa58748d0d31b4b1286686f3b156a419b410bf30eaa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 163f5f00bb3c37510f40ee583cb644f907e62a46b391be8e87722171e0457c3d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b8cb32c2004b69a33fda1f064eb736e2684cfb527fa9448fca284dd2b1bcbf57
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f3d86c49b7832e44ee05cd1206e4b02145b0a42c71a841ad89ce91d9635d1173
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c88746b3dcc51aa587051bc4d6176342cfb879a2d282916c6b943a159cc75c11
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3e1ab84df0dca34058b3842fe439a4795990cc4d21c3e052c966f745fe77bea5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 027e91e1da71cfdef0f4c4dec23a37a5b0a9dbfdeeef71b9b83c802f6ae4e32e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9a88faa71888846b12e38dc452db2be6e62100e6d1e5e9e43c7a170875f013d7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5a5380ad7d11c2df21aab5f2f12d92ea6927474bef528f1060fdb8c22a9ad42d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 78e0cfed3537e52cb326e0d4d322d9538ff51382ab710660ef0cd6713131582d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fe617353703ab7517b4e986a8a1f18c9e5919efd1d2f65879036bceaf7b753dd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9212d56a775ecfb149900b349e9c268b6255d6c84ac5426c823ba9ca615f458a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fb452ae03e495904f72205b9a66dc1292570976c24c0af0efbb89540d7390e2c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fa63011a0f462c21a328ed075acbdfd35cb63eb39d4924b366a3d3d77a6d2215
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 85ae27faf0caf2cee1da9e90d156940376636e4e564731685da056c8021e9d69
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 358a03181d98084727a6a6ebddd3da3eb465e79054f06cad9eb9238d38697d3a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 779d0f5ccf528cad9950149ea459a50d9df314b28c633c593786f554b1e92e46
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 30845288fb9ae7c5db75bba04475cb775ffd58b3a0ce59f04644afd4c75c8f13
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9bfb18b4410d6abaf2696db66d3649b842052ca1d0957dc8bcf4f58b37a3ee2a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 039ae0e424e4b9b8eb6f8175dfc4bd4d6ef2f40e304e17c6a8ef076bab719be0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9ac2bbe26b5040fe088dd73ae5179b10369e3fde908717e4ecdbf5f73f14d6fc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a0f1c58c885967f964a1cfcf1acc5ee321e2c41e1b4f8ba42f5416c5d9ca9c5d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 699110c1b7488dccc34ecfb77b83002a3ccfbbec9ee0e43244569961df58a154
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5e821bb19d38c368bd679e7ad5ee2179ed588e2ec5bbb3e85ef5b13bc5d8a66c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4d34667a719cbc58a09529cde44a14ad233347957eb71e729a2d5fc1bcae097f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bd04dfc46edbd586918b1f8ad3f1e81b6e1904ace5372fdff5b3692afcf2d1ea
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c292f19d191494fe715c35d0a030ae8257f3085598ea0a2bd02397eb0c41abf9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d89aee8495632150b511dd527f3af34fef4bc9da2774d78fbc83f2383f0ce0bb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 16bd9f3d27e2f0ba5ead24195efb58470ae99685cf30e604585e1c1603a834c0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 45e2989da295bb5d4a61bdc1f1ff635d5b374e066dd71c0b11f783683f6ca4e8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 49133376cf6d8448f12d6fb2d127b62b85138a74eb037a7cc2998d28abbae1e8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0f0316b41f0a23a8f4448783c4b8a3ff4a856916b832073696fcae457dbc150d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 93013883a0baf0e4a8f6f2125c983423e7ef4606fa09e5302349cde470fa19bb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9cfc3c5f5090ae9077fc3b548e6aea9687a8ef16f440b03eab76cba85406fd04
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4ddf9dc965f750409452ba561a4892005a50653d64527e023e3c4f2379a748db
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4e7e5e5958a1288435e6caec92e106b61f70945c3cc0a45ac76137abbfc38266
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8bf7ec5d55f849765c518581b6799a62ad64d7c4499ac0e4b7ccc6febea29457
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1343fae80ebbad0e6f0953319838f9757fc06064538a16e2850b5f8f91e32ad3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b68f6b19baa375117604674d3d115c56e3c231900123bbccf6ba2bb49177ce4f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bc40e184139212226164c10ed93b9471559f98488142808bbe7ffb722062db92
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4f5886c0b46f717371487d931779733d9f480c0a72e19d1cab7642434bbfc7e3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 78b295beef775f62c450b233ce2ed50d8c133cf6690a86281dad1bb840d83153
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 df5a64b65425115cfa5858aef56d6b0ca1223f8250d6984e7444f52ad9dc5a66
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dc0134a4baa1552603e3c9c30b73cb0e1016bfd9bc80062880a94702935b8abb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 36d709f831e78006ed547e4858e8e0ad2a381db5e59f0fa7cb7c5f7a968df5e1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c983c84b489e24f68521e0d57e6373edac7486001f51a0101e6852de7f6b233a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 61d498ac6a680ac56d08a365834abfb44d4ce9c4840b3310e170ecd4c889fd62
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1aa1ff5b02211329f3b8f6bdbb12c7ccbdf3fd414441a852f821ce4952eeabe7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 212171d6ef2b56a89fea4efa78d7a973bdc1ad91f329b8fa5f4e688ca30ab417
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7f687f815f88cc3c70b57821ee062a5aed67c4a24c85f98cdc547948054b6ae7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4ed5fa83a8325d6f223f288488a51a1de86d165504592783dc33d29c1981e96b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0831ca2f97aab27c1aac0f3034f7f0684ff274c02b40dbd4551ac4ac577ffb2a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 035f3c9124866f4468c75bdd83958f54568d4955dbf7b4a8ca4a4959b85ee3c7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6f9768024addc6a5b48a1593ed369138f56ac589be5700f2bc048c738d2e8a11
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dbc4986a985fc22300211e192ad31354823c502e00408badb2989207430418a8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6cafafb3a78f5a40116408c8f8cb45f0b8040a5881a422a9dbb9785283d18f8a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d8dbf674e930311f98c1f4c532bb8899bd989b1318f54ae552de107faa2c3205
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 877d350eff3cb3bc2fb0084a63930a992c58e2fc7de08c420cd43a24b25cef6b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ef9534a90c06b1e765a860a18cea52008ad67760b35b36d53c52db3922da6b6a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 95526feafd979c9770676fa15324087708985ae30d32c9262a951d19cba2cdce
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6583f6b97b1cf3a7ab68054f4ca2b3c4c59927960a0fb1659934d42cdea7f5c5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9c6ca7dd74e430de4f9f648d81362fd1c7631c7572896a0c413543834fb6b23b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4cdf4e25e758d68fafcab3324ee9d89134174d31653ce76aacba590512b0bb6b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c1087ebe3620c3c8b6fa0fbda3dfe0ed92e3476e727c87b6059fe7e24ddf9c60
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2dae1967e1621c4ce7cca838efd2c1b431aff76c17fae5fb8971da51f5c8234f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6db630307f8b72fde9e6165e94b54ceec6ba046ac073c9f45ed1c2929f117419
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4c14b7016b5a2f08e2dacad9156924ab31d1f3ebc33eb097f952a396e65e602e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e27b6decff8af675e5c6c6d7a208020ade6bb6e645ef920fbbcbc33bd433f1f8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d5b7771ddc2e756a1ba333dc053fc071273b706bd975865409229dbc115f20f1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6c28742990cef6dc08045a6a4c35543f18011fdc2af325f82d8e73c80c220734
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 89ca02770662cd84bfad123a20796bf98f4efff7a4784ee0ce7f8fe860f45698
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1f3571228575cc5701c9592c1744ac8d731124fabb99500f63f843b31bfef3e3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 042ea4dccdd3316c9aa37ec312b1b47e676e4ecef080b7b937fde8c5d027b9f2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 52bd9344d8fd68ed3fca23193e4d7e9c197ac22fed0aee312227bb71236f377b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ed2fb4633471fdeb2e38aea0e3337bc92f7fc7faed049ccc5bc1205479a1a403
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 08bded666362f9c59b3416c0f1ec85a5a950e1c19d5e3469d10862be6a56cb8b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 82290f0998bada7e0c4c62c11dad3255ed8d8eeb1feaffd2d8718a6e7a9dd049
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ec4de9c4f3a544f433dda9ab74363ecbf749f240f427f312b2018467a792f46a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 befd66f79c5f47fb65d0afa57915b30400e648747c4d454ca3a21ee2b7d408e8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a51f447aa7c9752d1e82788266935d4a1b77dc4765eeedc4a59d3dfaa56b020d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a0f95872768d7d191129bd83736523bfe390b8170c5624506d19edb2224fb342
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bc062e59be21d501a37dbb69fdfee9fb0f34c540e2ef66235fe819bd6d5bc2d3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9d1309de17dd26c58728834c9fe4c6917fb9a807be41d9c53f2ec7a6ee4c02e5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5af111edcd1b376010cf9352b5c2003780e5685d40b089fe57102e8f8ecab10b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 373f98a118c5ea82bc3b49916225ddc628875c8485e2705bdf09752e52082a6e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 11743cb3e814a131e7f9261a54597a817ee4428edc74278aa4f83ac7299c0b5b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1a095cdc0a4e4e97970310f9bee697dd293f0c7afa2c750fc3057355479d4004
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6aca1d431afe1fbc5ffab1691cb61a2accb6d90409a65bf12395393dfa01f082
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a1f527bd1486155742fa9bceab696a8ff482cd36b1194f44f5f43ecaa84bf364
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0efd925bb04b1c6194c9436ee605b1b0b8296eb000415f309b844028df0545e6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e6221fcb9bde8b043f8978ace22899a7cbd77c3f5a2e91b7a561db99a75239e7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a7569663cfc214968b03e539bdefe54ea195e91b9b43dd8adbd66490b81dab66
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f72f4a3a86eadd39e13b78462ad840d8df88cb32b417c43353deaed446a63d86
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 152a59918422983bf6eaafeaef7fddfa0872e9c417436e42fc1a86227aabdfe4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 db35841f6d73985e5077f20d4019d43b28949f54cc7d9d73be36e837778d82c7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b06f69eda26a7a8d40b6e3981dfc92560c174510dd490b974c239ed30662516f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ddfa9a79badd110936dbd46aa8e605bca8a3d17940db92d02d09e6c24ebc0d2c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ab0fcb61166230c85722f1939a2d0a0aac40b2e25da6fa305ead54febab14631
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 60a0ec87a99e6772d6c805af0ee6c8f5e12e46790502b1faec707a2e30910111
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e85f1e8cab019297c1faccaa1ea83272b16f8908f1c8438b563c5257edf813b7
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
            • MD5 SHA1 SHA512

            server.exe

            • Path C:\Windows\SysWOW64\spynet\server.exe
            • Size 392KB
            • SHA256 e8ddcc0a6281b068bb70d83421e9810ebbac24e58cc0185eebd23f5cdb33b325
            • MD5 SHA1 SHA512 SSDEEP

            EtNDuISBB.dll

            • Path \Windows\SysWOW64\EtNDuISBB.dll
            • Size 1.3MB
            • SHA256 2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce
            • MD5 SHA1 SHA512 SSDEEP

            memory/1036-264-0x00000000000E0000-0x00000000000E1000-memory.dmp

            memory/1036-938-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/1036-562-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/1036-262-0x00000000000A0000-0x00000000000A1000-memory.dmp

            memory/1228-19-0x0000000002AC0000-0x0000000002AC1000-memory.dmp

            memory/1356-941-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/1356-937-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/1364-18-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/1364-596-0x00000000001B0000-0x00000000001CD000-memory.dmp

            memory/1364-896-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/1364-14-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/1364-15-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/1364-329-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/1364-13-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/1364-9-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/2360-11-0x0000000000400000-0x000000000041D000-memory.dmp

            memory/2360-0-0x0000000000400000-0x000000000041D000-memory.dmp

            memory/2360-6-0x0000000003710000-0x0000000003863000-memory.dmp

            memory/2360-10-0x0000000000290000-0x00000000002AD000-memory.dmp

            memory/2856-597-0x0000000000400000-0x000000000041D000-memory.dmp

            memory/2856-919-0x0000000005B30000-0x0000000005B4D000-memory.dmp

            memory/2856-4684-0x0000000005B30000-0x0000000005B4D000-memory.dmp

            memory/2936-936-0x0000000000400000-0x000000000041D000-memory.dmp

            memory/2936-931-0x00000000002C0000-0x00000000002DD000-memory.dmp