Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/08/2024, 07:02

General

  • Target
    c280ac0d95c3f4699dd374fd8ce022db_JaffaCakes118.exe
  • Size 709KB
  • Sample240826-htye8asfmp
  • SHA256 923e5fe74fc87eda8126349a9bb0422b9433f8a0bf121549c78ca72ff0b92127
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • eu123456789.hopto.org:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    iexplorer.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    wind

  • regkey_hklm

    wind

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • UPX packed file 12 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c280ac0d95c3f4699dd374fd8ce022db_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\c280ac0d95c3f4699dd374fd8ce022db_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:8
    • C:\Users\Admin\AppData\Local\Temp\server.exe
      "C:\Users\Admin\AppData\Local\Temp\server.exe"
      2⤵
      • Adds policy Run key to start application
      • Boot or Logon Autostart Execution: Active Setup
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2808
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe"
        3⤵
          PID:3164
        • C:\Users\Admin\AppData\Local\Temp\server.exe
          "C:\Users\Admin\AppData\Local\Temp\server.exe"
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:220
          • C:\Windows\SysWOW64\install\iexplorer.exe
            "C:\Windows\system32\install\iexplorer.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2260
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 568
              5⤵
              • Program crash
              PID:5044
      • C:\Windows\SysWOW64\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\comandos netcat.txt
        2⤵
        • System Location Discovery: System Language Discovery
        PID:4432
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2260 -ip 2260
      1⤵
        PID:5104

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 d9d86657b44737c58380a804e44558139d330bcb6bb19f56365a7b44854a7986
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 229KB
            • SHA256 177b2dca432a7c234d8761228dc7dfeaecb166908eba5e3cbf0dfa31d4905c0e
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dde9f58c1deaa303563d971815f63c1d1b3b9fefb538f4dd965c9cb119312990
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2d634c8ad76f2624e827c1eb3536dba64f771989e318d14ac2696c4ed07f0803
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2f38aaa9ddfa2d00959bd2b61983c12d3f71e390dce62c07961ae3f5e4e0876f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 262d52e3ec5316be05872d71872dd4fc0504bbe425577ce10be4d2cbf8039212
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dc02f6c10ee5e68aa351be96a91afaa8d2b6d05deb29c8b5e5660869c9b4e8d4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fb9f32c22d6d82a8145a2da8afd6c37fe2c573b006cb90684f7df7c6dec6a5b3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c46af80c1e6e4a464d9817c5d0c3c3d5cdec647940d9f55e727adee25a8a1ec8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 88f16cc18c0a276d4c7dafc1cd243d49feae74d08aac4cbeef2c2e6c20e1bfc9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3222dc8b92ada616a45bda24d7dbe25b925cb34662abe5700e2ab760893a1b3b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 66572842cda2d6b4d734df95875b95185cccabbd18b3fbdc246f07bc4dddd4fc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d12300fc33ae09eb2ad04c60677b8537b535e10dcb98d0d53f46a01da79c79b0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ae88c91cf4a51909a4fa09aeca25701b45021ba694f4e2edb1029bfab243d11a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0e74aaf9b47709e90288bb828321afe034a03a703b483d12161cc003de9d3d36
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fe9f4083a4b1c2229e16a0ecbf221db5e2080f87565655ca2ae321e0fe22bb84
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6844b46ad3ef489f5436958a0b06b1c7af2f416870a856c541bd95af53cfe220
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1e2c5e71f91a2da23b703373162b724c6c504936327604f5ca7884b0a963dfaa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 56c876d726c57d25b43cd9097d423519009509ce93ae5d95c46e46590597d6ee
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c131d6ea6b8a25d7318a3d482e56c148879bf6ba3cb7a0b469f58923400432d1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 167651cfcfcef99ed4ddd8a8e440bb0a9b560bbb8a13d352fa533ab8a88a920f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 27854399e843a27c00b3707b2441f6f988160479b0e29909c57d9c4b8755441d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 73dcec04b9352b40ee634afa738c6181f0f158b60311aa0d0f1bc540ae03cb2a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e24ec888ef41355a941a733fb1632ce2caed16b4b18efe8464febe52bd6b460f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8dd1758d518e42ecec85a2a0f0f260c97cfbba6e5e154981c0964f20e34a7463
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2d69110f8fa121ea01e75f7a8d02bbba41ae03556574a1b3aec1997f1120320e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f2501428f7fd3c44525d475765a257414660bb2396b56aed7e70c4a7d232eea8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 30573d114ae19d0674be93ff5e27dca652e3ca1d55bb733dff10c999a97dc330
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 43e4c0c9dc8172a8a17cdde7577f24a420820e6ec8f3452b813a725e3223e8a8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cc69b0ca75736aa21ea79fb65e5d9d4e018025571e44b6513435baaa75e942bf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b3efd1710dc344518f7f965b94ae48b3a7cf7a090905a3fe986a242e316ae739
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9f6f39f55a5cb3007a3e8e2fdf2398ffb71b13eeb998897dbec902da9539a484
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e6563404bfd6c7b0b3fdb8e9ef5308fa1c95698008bde56cc1eba27801f6abdc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 adbb83b95e3b8014b2661fadfb8d6721797c7d3e042d798e6ef955a3f3e91826
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f272c7ab3ea4cdf2c7bb65ebbecc75440530af3aec44248ec800b12acb55949e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 398f99529b3ccc1c7e5f210e864dba7f56a3366acd3210a30bdaf8155d29a631
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3fd5ee0db48776546c9add328bc1814f7d12bbf4cecfe1360f2dba93bb7a2b7d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f6ae01a1ea3bc2a98444bdf67a3e4349e6245bf1aeb3268e92dff8be9a74da7a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a83220164477c07929d7dcf04487f2e659b84d1d70e23b3dfbd8316fc5fd29f6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a0d12e554f8efd1b3dda403bcf8223943fb8f282355bf057ced21fde970802ad
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 779c2a925113b49c4d2ea2eaa20d5c23d9194d8b3ac98d205e7332e9e74c6cdc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ef1405e0e5eb7970bcea0c918ed9612ba9bd4e042595b62ad0255dcb2257fe0e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 de900dfcce9e605c05fa155c173f0253c74cb36030397d6e4165febeddb19491
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8344590f8b558bd0c6467faf8d07262081ee4e2e47e438455d9df6b9426340e3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fd03cc8888cb34a183fd69720636222304c85c1b02a76040fd8fe5b3463356fd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 57ef4714027b076149a606a6e0698a278ed1426fb94fc827dd1e3e953639bb7f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 252199942e1530793ab99538346628ef29447b41f04c566c42192cdf4bcfb89a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 67320938883f591d9d26cf29b9eaf7ae2b4f9ede66562a06191b52c8af20efa2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cebdfb46299f1fe1a34f4b1658817e93d25d330a2cd0ec420acd9e2c7940afe5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 70c78b66b768a48de1b73c250f5435520512d2d09ce2b91c6063bf9c3d8287a4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cb4eccd93ccf9e42c0214f1907f06740f1c5332f449e695cc1e99e41b3bd67fb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5b8e332c5195759f59e46c97e4c5c705bffdbc6da36f459cddb50f4b794f25e6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9038aa7d4de5980c57f6d14260b342c33d8f77cb8fdcf19d034d857c0124ffb9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dd2e3f6d94cd85451d7af39fedcaa0a96097079b5516a0c8c44d82d59f8fede3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e5a5d6fb3a12839672519bfad925830c20bf14ea5ab4929e169a1d828d5523b5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6c82206e15241ad2ba5ab61607d30a5347a3f54b6193f88b0b32309d77e79f9d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9deb05d88e6d7414653e6e6a0592eb8a0c3ced7749a88e5dbeb21acd2edcd167
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 15bf3e8b32d7ac33ec967696f6b695452eb079e943852ab41be6efad6f957ab9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d43d0e5111fdcb43ab2ca3362110e2058d6f17c644f39e56c4e9dbd183ce2c0c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 23a5b63e2f2c4432a20e858214dae32ffc040f027c33e0e5b2356f8c440f8bbe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dcd92b68209fca84a89429a0f5b222cf66aec2a63f3af20b2913ca548727c294
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 069e9af0b9761ccf4527caab9633d82b44dd3c5e7a62cf0c514063e3f3309962
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3bac298a14ddb66e70d5335d350ffbbd9b652e5fc2f28508a0ce27fb7dc17dc0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 65c37ce8bfea6d90c9c9abbc12e8b77cda8e262dd1e5de77e1fa8c3090106b23
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bd1b60bd9f855899702be74a7e0e75e916a4c716b25015bf2d433ef81ed1b9a2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 82f29bb84c0846b937427d211aa0097d09b81dc99291c4ecf2e4e14447c0d539
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e5b96d4653d79c285227beeb632eacd8d7d59ee2fd1d30c83bd35527cc55992a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5b86105482fd875f1f3c6a25aef992ad97745abba4787aa216c327e30e815209
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 65ac23e96aa947e22a12cbdf6f48907b76fc40579ac5f1b502bea78cdfad8a2e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 21da86575680d1567e625d18a6ec72d43cb6255a9b6f6d1582a86c6188738e81
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 303e85c4bfcc9bf08518d359db6b86352cc8b07bf25de62bce8e4e6384176ec4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 161252a8b872454d5670d62d2ed7fe5ee1e94807491609246e8c7a54f80013bf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cef20eb9361fcd104ad59dc75e68fda83093b939f9fca98e175c8fa1f8d8a2e2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4c8c4a3db1e67df8069c489bec2fefea2d34cac9dd1a2d4b1a6566811c8ffa91
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4217b85f28bde541b0ed5ec4629a8bbb645d8b826a3655a7928b38c2884247cf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bbc65e862c519476aa0a6d71b3d2910eba5ef2104a30b581e85ae2a5d16a25da
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 29ed09b505ab995af1d314544aedce5a3bb4b4e21a6600686f2689a7271cc5d7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 81265c2161808c87462059f8a590c8e51caa86b9e05a10afb3feb9535dcc9368
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8f32ddbe310c8991b76306cdac1905098b2ace633e76063cdb718d6a9578cfe5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 359912b3860547c1bfd8807c1f608cd5ded85e9c1767a1393bd4b3b8c570629e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9999c0e2e8ace696fa48c1be81f19fdd7dc3b6aab4e58486ff118c1bae422c11
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1a66fb7ccbdf8bb43f02d7c08ca17cc64ec6727ac6cad2e3834e7b93e8f1ca2e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ad1cfbd9f9604a5f31f6a5bae3f4f607ae2b0463e45fbacbdc1eb206923b3a62
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c0c069e82034aec5f4f40b90f9d65ec4e26c954fbc4f7c7561a5166bf2329562
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 12c857f7ecc2e0f802ae0f395b57f3f3015e0520a0008cdac63136d7d2603f31
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b5b7c12200854b02174ff2a9abb6c15f9d999a75f77ee98fbfc198e3fa46f19b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fe43a37fdcf5fba0954fcda7fb2fb7a98c83ed8f9130a0ab5f98008353db8b6b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6e9119c52b0b3ecb37a6dfec08e6a32cd325dbe52cdbe76736163189cb03c808
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 06485170621249a72a13c7dad21f602cf4a5423dd83f040ec4c5511517759544
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1cc2f462fa226a8d75310a0711e9a562cec89a746cdf57182ae0eb87446b128f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ed8b6e5b59511749b109e6f3c6b943e8ab5314379d9d2aca1e1dbb3d79491e99
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 758dc4cf7c9a521daca3bcce8f0a55eb864e528e59177799ee0e24bce017110e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7aa0e5a85d893f2b379bba079c7853518f6e11459e171e4dacf5011ce37d1b78
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c19fb3c58d01234535947260e55876ea18ddd240a5c29ffa50abef313f307abe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f4e0c374d9f94a15175047966720feefad0fa01c85f79d67f228219e55cdae13
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6857f333f4b1251306f90042fcec51f8642d076be0a82bce20d72d983dc5678d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 deed392d1d0a62108d0cf4daea60e9c2b041092576255bb48a3ba2ca15daf85c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0e638503e5f0eedcb36343ec50d2536d821e6bbe5235e503422c145a681525b1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c1e9209142f3cf551df7faef319a59cfbf10b66c8094f8e8c1afbfbafb7700aa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 42d21b1896c1d1839e125fa4abebd5996b40a2c8810c1342c2fc84b52a85bc80
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 88eada501de1e59be6f14fe0a9c2f7e0aad7a4dafd20cb056d2598e45616eea7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d43112b86b52802a86fb7477acb96041f105edecf67904db3656498cc5aa4f61
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1ae1edfbcc4da7bdefdc0df1350af6d89881b08b77837db34d64526fe3a0868c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5dbe4da514ef8f17cbbd26f1dfd3705b118cdfff12fed8423a77ee3053bf2ebd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 900b7165df6f6d2ea69f373450e25fb47e4ab0561a041e0713308c95f378acd8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fcce267168f67d2ffe32a479ac73db7b6c304ffc6d73179dae594171cdba62ac
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 55ba08a8424a9b0a0f009caa17bd4ba074266a92ed34d8a55bf59667289aa264
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8c70a49772e4860104d4c3414c38ebd4f0e7c6054b6bad00fb9cafd692a73abd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3e857d1fe39af3f125fb55cf1431aec2cbbc77cae76415a763c3fef6503d3cfd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d3a6eff1a2258d427cddff90a9c10e11b14159bb4742dda5b28ecd953e4057e8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1afad348158cef186208060908e80136c7899fb6580d3f287f60ea8a3ee5e035
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ff74a5c58c235d111df97b00505c3a1a2f367257bd7fbd4116534b85bb91007d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e445a04001b70c39361e006d8b711592b20d6ccfef8ec54ed3207db462a29d37
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1721b281337bd73719f6e9786b51b12a0bb6ffe4fb5f2a1d5454c1922912b9da
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 541ac0c5042aeed62cd6779401d7479471c5cad7fd39c7b466c63b199f009acc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 45dcf325ad72079c5e3ffcde7c13a6d1ecb358634c7fa704a299e249ce18cde5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ffdd09bee41786a03c5b03ffb97b2e3d9d0b64771cfb0641597214d447896ade
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0221db7f94acf39abaefb0b6a5911b2e9aac6a15f687b24c13ca08806ebb8325
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7f3c016812fce64df29822607906c556feb23295e05d1a1631f22ac90c995918
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2e5bdea154c343481b058f8e705aafec01c05b6fa914457bb3b601da390acfbc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6f7a07b401c2dfbd720e9f2130d8718b1ee3ec5091b90dd1c99c798bdd95bb2f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2655a6dad070b1198bf1d417e92023ff13894a38a108527d05fcaad3c874321f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 38a1ec6e57c9c231b956ead1eb0b890097188b67d1fac92b8978b0235d299eea
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 89e0845d06481d4c71528261b836b9a17302a603b8e6420947ab4e2252af7d30
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c70746b06477782907e7f88bce9248ea20384f1b3b98aa0a76c1bed584e19679
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 86e7b86fd0f08faf28ec04c5f7620133cd19bb53547f09a99f432dea2e3dd5bc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 230731edfe02413da02d37b6ff55140f33144f2605aeef6eb54a9a86e20ca1de
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 529279be481f2ce5f6b67f39d67447d454ab0a7f36f7041c3b01370e23929b88
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4b30a088ac75fedaf5f8451b0c34667b28add95c59225eb5a1c511ac030982b3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1c848ea9ff3ac46806fad8209f44f8f8a2d199e8cc6dbaec4e10599fc3b65068
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 48518f599ef1d3c98b4e61df92a76507111198dcdd9c896602e0b494f69c7d59
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 98467c7f49d9a7a370bde35e396696313c8ae21c7d82925eb688ce7ebc0d9d09
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 43d62771ccde84003dfa4db00737f54f7328695811475fd5023b3ccdccafea51
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f3b91b25d18e073edc76868995054e9db16751b1d16c622ff09a097ff3c21023
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 92213ef23e10fed6de05be954ba212783078f5c41bf4e9fe1579c92bd0182b0d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 93d17525f6cceb07398d4482211edca5f428b020eb2370ad2cfc092bcd5bcd5d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3eba41df5fce6e4d415b070f3956b191759658e037c79621495003fb9ed9d1ae
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b14aeae36a74203f4861753914ddb6aca68579ceabab2aae07174415ff421045
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f5248a7d4007ab330fe36543bf3053e643c4f7dfb77ac045518f70b16fa7f164
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3c0866663022038410ed7c28b2f178dd1fb547418f0fbde187557f8015cede2c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3738e08030bf822960539aae77bd8153a0462a8af2c3e9a4a5df22019ab3df76
            • MD5 SHA1 SHA512

            aut7D6D.tmp

            • Path C:\Users\Admin\AppData\Local\Temp\aut7D6D.tmp
            • Size 276KB
            • SHA256 598e287ac27061f3355edb9b237af3a3490098739c7308216a1c028d4023f0d3
            • MD5 SHA1 SHA512 SSDEEP

            comandos netcat.txt

            • Path C:\Users\Admin\AppData\Local\Temp\comandos netcat.txt
            • Size 201B
            • SHA256 7ccdcb2e31fbbd594f1e4006210d092a3bfc6063bf19815f3b95a8dcc6aaac6f
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
            • MD5 SHA1 SHA512

            memory/8-0-0x0000000000400000-0x00000000004FC000-memory.dmp

            memory/8-22-0x0000000000400000-0x00000000004FC000-memory.dmp

            memory/220-32-0x00000000005C0000-0x00000000005C1000-memory.dmp

            memory/220-95-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/220-122-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/220-126-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/220-31-0x00000000001E0000-0x00000000001E1000-memory.dmp

            memory/2260-121-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/2808-26-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/2808-19-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/2808-30-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/2808-88-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/2808-94-0x0000000000400000-0x0000000000457000-memory.dmp