Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/08/2024, 22:10

General

  • Target
    bd5ad9522aee761f4d7cd1cee6aa4fc0_JaffaCakes118.exe
  • Size 276KB
  • Sample240823-13skfazdkf
  • SHA256 21e9b48f3be72a4af4d6816c488785420f1baeed4d532be436fc1851276a86fc
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • your_dns_here:81

  • alawy.zapto.org:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    spynet

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 13 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3428
      • C:\Users\Admin\AppData\Local\Temp\bd5ad9522aee761f4d7cd1cee6aa4fc0_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\bd5ad9522aee761f4d7cd1cee6aa4fc0_JaffaCakes118.exe"
        2⤵
        • Adds policy Run key to start application
        • Boot or Logon Autostart Execution: Active Setup
        • Adds Run key to start application
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:1676
        • C:\Windows\SysWOW64\explorer.exe
          explorer.exe
          3⤵
          • Boot or Logon Autostart Execution: Active Setup
          • System Location Discovery: System Language Discovery
          PID:2328
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe"
          3⤵
            PID:432
          • C:\Users\Admin\AppData\Local\Temp\bd5ad9522aee761f4d7cd1cee6aa4fc0_JaffaCakes118.exe
            "C:\Users\Admin\AppData\Local\Temp\bd5ad9522aee761f4d7cd1cee6aa4fc0_JaffaCakes118.exe"
            3⤵
            • Checks computer location settings
            • Drops file in System32 directory
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:3932
            • C:\Windows\SysWOW64\spynet\server.exe
              "C:\Windows\system32\spynet\server.exe"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:4260
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4260 -s 572
                5⤵
                • Program crash
                PID:4304
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 4260 -ip 4260
        1⤵
          PID:3656

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              UuU.uUu

              • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
              • Size 8B
              • SHA256 bea4e7d31419bbc69d9471cc961cb7fa69c91b9d31bae814f55733b58aa5458e
              • MD5 SHA1 SHA512

              XX--XX--XX.txt

              • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
              • Size 229KB
              • SHA256 fcd6089ec42c67d17e4db07ebbc2ebb8794199f241cc54fd9136c9d71133eaa9
              • MD5 SHA1 SHA512 SSDEEP

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7c772850d305adde377ae81920db786a6c684b747ea5cba892531637c5fb2557
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e32932e41cf0172bf136f00465d66626d9ba0923f1cf34996a175a86b4969c11
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8fea23a8cd702f10b60d8a0366d653536c82df4c724e912e74b55ca82611cb51
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 38ea93eb9a1edf45eeade5fba1b4ab3eab27ca7f11c3ae30d96c765b883fd84c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0b073c67ee5b4b2e8a433e14fbc63e4bdf7de33b00d2687c1244f93cef5e308f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c9116fcf92aa6e0b74ffeeac8d6fe43ec606bb84fe623401d22a7c43984c2e30
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c7aa408ce3ed792a495bb6f4a4e3f5dc60cf8860f5c25aca2c6c1cd652bd535c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 06d87804f2d170a107206c54386f6de697bd58d8c5aeade46a441556b6f7a7c7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 21bd7d4f3f1014fb49cdb9bf4b3ecc4add7104c696c9eb16c1366ac06b454531
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e2ec164b3bda50698dbc014b09fbe2e30aa11ac0d664d4b7624fe83972a0e31a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a3051ffdb62e3051069aa0dfea27036d5e65e253dc95a6f15a6ed3cf25c8b92f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 30e58bdca671523b532fa57947ac433332fe03e96d8153e44e92cb912c0ef929
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 88996b7cd643b8bffaa12a3121d15f4fd263e30585a909dd2559cd97a74aed02
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4568126d609ef5cdc25ded6f1f1b58747c9d426b5aff0f1280c1ff10a3fb85c9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d8c9c6269600e4437eb83e8b926f0d6f0b763e08cc237c5795acaf8673d6f810
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6feca75b182a363e4d08005c4f8377b61b2c94de6627f80939eff8af7be3c463
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7a6fb7fa0cde3e7c3fdbb1ca5ae64e0a836f2d3bebd808b9d3bf94e81cb3b16e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 07182cdba806a98595f432a9487fa8861c78a15bcf7a3f0c865e37c1637e9437
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 580206970fb71baf50f72d93477fcb14444dcb0201dc3adaa9e51af8b52f5348
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 10f8812a7c7b26e0941f5c74995a24d7f426a0b43f41a3f4626089fc93ec1ce2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b9642cd8050c3ee223e9847071cf460f9c556a15790ac2d888b6e8bf7eef737d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 69c9ec6430252db53dac6d00a07a1a7afd592f4f4359535e0a5506e6ab49beca
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 331fa09cef92fdd67ef2eb4edaf6f07a990c2ec000397ada22bb06385c60a36b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 36101a27a8fe1f74d00948fdaed7212b541ae7e24fbcace1e7e127bb641d5555
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 db9a5b9fa0a29a773697ca946e99c190a3aa8c99754e645922ac968575a79ade
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0921b61655d3f23303944815ef3798f9056cc7632a2e0966911616dd2d48f5d9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c19073c4418e842dba4c555388a9b9aee5109e41d28719159b5b2baa37680b47
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 25835820c20922caa93b39b6ca1bb1e3b54107f7ad08852468bdd258cd3c1052
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3a68bbe2e905c1f0a7c9b1c562b6ace3eb7ec9b28b1d45c089b6ff60adbeb312
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 09e69e2631fc11c11b61542aaf8f47af0f994983195af43877e948b373c34e4d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 612d94ff2915e3b79c801f3d7ff31fce12280370894469a69e12a13f89b445c5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fa94c40fef14f86a54eec6a47ad7277f006da45cd577cff9a43dfa40651ca8c0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 07bb9ba59cc457892306a6ddb8a0374c3f9e179d57ace23968d7c49199ec8cc6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cbe2620d27e9c89425aac7184957eb5792cb88eed5f29ebb674d867124301c3f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1f4c1220d35e1cc13e391ab73ca361f0d2674e115b00634dde25cbc574dfee8c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0f62171db2c9247f3154c6ab86e07b105ef90cec14b8ad3c2387c3f16d7a9047
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dbc28aeefceb22f460804be336738acf428e5c3fec2191ef73854f2c26f95a4b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5b81992395d4be899b9c09fdecd1d5a9362e463a30d5f93704e91a5223dad4a5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 663f4ca7262dcc3712cd12552cda4b08ec933d54b7049a9b74b9d369c473a67f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8da34fd8288c52249635ebbe14cf92725980264bb3c16d835407b8bf6f35c98e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a318f781e7594a3575d975f05a43e4a0d6407beed3b33cb457b3bbca595a8fe1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c06819b1fadc27277776d48a8bb489b8def85ba5ba878f7dc00f4221410e0ae6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3b179d1b517ddd18b254c199040a59051b742db1d36a406e754a7edc38b6a949
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2387c7c469b8a22a219997861f617a01a01a72a9347ae5b5430b1d4b70fad8b9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e5d507e3017d32fe33fc12cf8ba7fcad3510d0ca1192bc70516bc4316430a0f1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6299f7606a13e48d914cb80f606e1e3fe1d9a578571da3c28821420148de11ab
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3ddebe865fd0a2ad356c56d7b1098440540773d04931ede5c98b50dd4156483d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2b5edfd15bcacfe3e079518c5d6bc8e65dfcb658ffa442d121f750701ffe0fc7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c94765209d406c382a85c715fd01d7be1bbcba3b5f191440f6f2b3c8eefc747b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a017c58f1268596d3134f7c0e877fb26304da3a7c47e7899e15d8b72637e3ff0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 827dffa436eba8345757d1835e2b5d0f3933d83461fa7025f63bf31c8b903856
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a31c7548207a29d983054c2ccffb3069663477f894eab603122a129271981256
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7d36502b2b439e6e94636f820a17375a37faf36d6dfbfea91ed3a05838c8d382
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6b6d9fbf3ce6e168dcf301bfb12c87b0897dd1faa4fc3d0b3e072c1fa8a3dd19
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8b1704b10ba53a653a7a895104af697cda186e1b27789fe2d3fbbc3d38a9ee7b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 917f3cbbd57ff28bab34810585a48790e5873eb5b929d55fab023ea0a4bddb71
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7dc623d390f749b99f84902f019a71c1a1f677018a7a4c93427e2d4151bcb229
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fc9df2efe77d17c4120b42695d736208857b240b6c3403cc63c03856c2a48bfc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fba368d3379d782701277ea64c9a9526e97772258488a38b98185fd35b0e20b8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c60440a07362c1506a0ca14466384ebb295ab5262fe9885ee97b2efdb73ee60e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e45579073632db5629cc36b4f9707473e6981c86c817c18cc580250badb0bfff
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c3b1eccf595044901dd0d5aa8b0283a4c62d894944f7b3b20a7fa0ecd0c286ab
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f27b262af4c6b19c5bedd3ef43c46a7bd299e75f60eaf9961bf31ec3b0de13a8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e1004c3907984f9950097ec2b9a0b8168c90ba9b0194b78b6ba0c3533f2ef153
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ff59a6c7e4505387012d5fce2c67c572dddf3d7ee13744e05f58af733689b3c5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a4a3c4058f81f28902e8e88c26f933a9a867957c9c6f18a9b57b30311aff38b2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 747b1e30563d1d6c7129699a0a7e68676c1cedc8ec3fef514e017e5363ba2043
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f704cc4d427f07a8d8a0052e5abc7e5fe473862ad5f3bcd85f3ec6282e55476f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b7022aeca9fa6957b8b497385f64fe4b23a47ac47f9f11134304dd2c0bfde3d1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fc73f54ac31e6c7e7d50198a8fd11b7efdd8cbf22adb0ed819b3c1ed22fe091d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5cbf88a3ce4c003cdec71ad76746125078183b0e9563e884af119198f8838084
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3141c7c7463cbb2c592322ac8a0c0247ab3d72ae44cf6a4a8f5b0c938dd9710d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e2b80b1fbe5841751d05bf46f1e28c1575db01278edf2fd58400a472469f6fab
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bea949bd3bf2aa527a61961a38adf8f47375ab79146265fe5b807468ca0c7300
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ac7bbec8b18b1b263531b01f10c9277a1fc7f788930882fd3b0f9f3ff508a47f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f5f9046899ee785ed94a34833eeed7b367b8449ce716d36cebfe10463bcab921
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9629a8bd79261de10dac8b4f6615fa752c4c9ca00022821c8a67c0a30bc3896a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1d7915c740bd6de526b9b8b9f798148ba651cf6ff1c5a2b7bfa002b5761b031f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 28c860e237038ae7045e065d55453480e214c59038c54f749cdf340b763145e0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0348e064bb528ae385873793c8fae2537296199c8cc45d33725409278614843c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 17037683d55f050cfbdcfaae7fba7bca64d09ddfe4c9571d89fcd71b039c9688
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4c223335c803371d8390f86efddafb66a96db03eaa18b74a761859492fecf414
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 aeb40c4e58bd64def9f68f061d21e807f15576263863ae6ac2abb3abb8337dee
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a36ae29eba85c89d64a247ca32f8584b7b6b07087a6ff814f83eee91949e3a48
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e4a82e673a1f041adaef16d0597970496a6c0e53c731deded4e6fe92d8d6aad1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c5fe073aff050c659df71c0dd62b839c8e134452c4957e754bcd5ec5702adf7e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 665cc357cededcd1e9ed8dab64b2934ac16b41ad5ec9f90bc6b010038d5265b1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 22c02b4c7848289b6fb1ebe7e8ae5354508d54d613b338500c2b38152a21bbad
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9484d79037f17e10fbc5ce103197070dc38c039e85b4c2ee63947f3b386a50a5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 39b4558625fb5f0576717ac0abef2d4610e9de0f368e346cbfaa52f28f2dbcf7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4e4f512a4180d0125a2d8db17e7c73b2b7e32ce3ff49385687803824ee854d8f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a744ef8fc94de874fc94140b2a6d87ffbbc9587619799d3085de86fd8bf73b63
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4ab99fd34a8f6b0065154d35755068cce2aa700c1f109c53717ec04d186634e8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e090cf7cf314b5405e8dd94c4a00077674827e921d91275204f0a161b5d945d4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4df6e7a0f09240753439ffef53753765049646273c90a384c7d6cf2ef9cc798b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e89ce2234b5ebec6fac3eb58a96f12e8cf78d7da92c068bbb70f77d9f0a3252c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 aef73ff21d03a91ffe09df43b0106b95af00266410c38ab5ed8085cc4a12d486
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cc7c0cbae06061c87e85ddfab1a9aa321f97ac0d1489914bd9b219a127174ebc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b7f0f7b31693fb377107478f6e09df492ef0a6af7a32c43a8352f7c27d412692
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3b86bca7dd7533fb3c0c687985cfb0a635a3a83007b31d54f8109ec010bcb661
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0120dd5cb6d706bfe369b32114a839cdac496c99ae44faf20b56a52cad694a66
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d1c19bc428a198c1bb43525de28dd88e9676114ae52dd040425b111d7832f9d6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c9c9ad530621492a0c00f1884ce165b6f81ca961c35fdba7045e8df7a96f4dd7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9926750948a1bf6604a7e886cd3d3226402ef6ae0d742ed4ef38457d2e419f81
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0722f1f738c87f525d3d90158eafd875c928c30b94dfda296e54f0e70693c358
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8a81b00fe7c949d80e1e7830b45fcff15b3069cddd1b15d912c747331054f53e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2321a82b37fc067b869dc533d84c8cf4f8ee5847393d9a409473ef47fc7b3cd6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5055b75edda97e314c968e2d09166c44ac0461823b3521d21aeba5bf78b56e12
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9f15fecf5bdb3192f626aceffec4bf2660c90a8475fe463976b6b2dce235606b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 59d91b494959783a7ae19c95383c9378b91e7c860526be2759d2edd483206ea0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a127efb7e9a7127c01ee0027613701bb9e3f536a1664c682bf6c21bf93878661
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8fedc26a092ce2eae384041bd20b9a83f0e2cc2e8b399c182dc65c5343bafe13
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b76a3a3b8de3a49fa1caf2923248a7c2423b6ed815a6de94ede48146ffc51224
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e579871311f01c64ec8852bb70bd905a56fd9c223ab37f711deadd6a08664ec2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e243b09b65098a079b165c9e93233f536cfcf7c01c0612e2bc4d781803d66cfd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 590b96c990bb37402d863d6dc36169b8ea93c56d4e8a617ae921a7926edeadbd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6b99df725d7835f29b837f6225ba152701f49921321c8472e837da9fff4d9df5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4d35e832651f5502300304118a195d8b2ea371f10dfdc6f59281e81a22df755d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7769481270896bf103d4456d4dbc9f0e139d234d6ffc7500455ebd85ec421a22
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 eb1f7a0007b8c4eedd2fa2e5096d1231f6584b91bb9795f7fd51d6ff03d931ae
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8a1a7ded10141d7724abc72284a36acb79dc5fb7716561be19c274d20bb06b6a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b6340e108078668a62cd545b567377002997a212c333d377a9275cd2a461251c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a988f51abd9d67092c0c8353fd93c1f2a4618eb7f45afcd7cb0ecc1cd5a730a1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9cc872562f4ac774b2f51844622141d22f3e216c0e99678e5b90eeb33e0da774
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b54617b328f05ef086eaecc0522560457d7394cd9fe5febd8227fd766b0dfaff
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 10aabeb33a97b4c59d027d785b75ba2a6c33bf3d1a887b1b263cc54f0a14318d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7df0c87da309842e5fe8c7c0ab4f9dc69453ede073af70c42430d628e6cf26a5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ae8bb146c3d6e339b1f073ae33726845c566580c949e194d091acbe1d164a2e8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ab2c57f2a73e4f997124b06895e7c6b8fba20592aab6217321e2292596e30523
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 20fc07d489cb23918630fd4d8aa03de82b980fe0b38d4bf8ced7ca9b4902fb9b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 793db0ba825b72a88243c4d4581e3891637eb6e1cf3eedd7371313103f5c51f8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 eaf8a5d1ac05de9babb0d6d7f24ef8095abc60547838a739d617948544ea4ebf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4375403a2fc87623b394fd50c71fbdfcf10d9cd84d163d5395359a6fae853a06
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 abff622787ced79d3690a8e3b3ea62798b3090d4c34ff751b8df72dd63b451ec
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 09033abe4d7b9d5d9dbf7fbeab1127f485e4ad05dec432fe09a4e18ff4555a2b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e38e5e5ddc34fd19a0a28c02d3aa3a57e9cf9e6909f864e0e0d168a7fa020a13
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9775548ed3e18b72d5139c0c382f9d9a102bb2f322af31665b31b960edade850
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5661abf12f3a60d71c4c139b1ba0f397b8196ab5ead0de4028184b87ad14c4f0
              • MD5 SHA1 SHA512

              logs.dat

              • Path C:\Users\Admin\AppData\Roaming\logs.dat
              • Size 15B
              • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
              • MD5 SHA1 SHA512

              server.exe

              • Path C:\Windows\SysWOW64\spynet\server.exe
              • Size 276KB
              • SHA256 21e9b48f3be72a4af4d6816c488785420f1baeed4d532be436fc1851276a86fc
              • MD5 SHA1 SHA512 SSDEEP

              memory/1676-4-0x0000000024010000-0x0000000024072000-memory.dmp

              memory/1676-24-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/1676-0-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/1676-141-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/1676-65-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/2328-70-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/2328-69-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/2328-68-0x0000000003E30000-0x0000000003E31000-memory.dmp

              memory/2328-9-0x0000000001340000-0x0000000001341000-memory.dmp

              memory/2328-165-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/2328-8-0x0000000001280000-0x0000000001281000-memory.dmp

              memory/3932-139-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/3932-169-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/3932-170-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/4260-164-0x0000000000400000-0x0000000000457000-memory.dmp