Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/08/2024, 17:32

General

  • Target
    c566cab0ddc02c5d42c2b814a4adfa30_JaffaCakes118.exe
  • Size 674KB
  • Sample240827-v4pmaasbrf
  • SHA256 2e4c502745e32f85cdb0e7fc76d2ba25126090ada54213f7fec082ff2bcb1587
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • 195.no-ip.biz:1338

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    SkYNet.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Erro Descupe Consute o Criador do Programa

  • message_box_title

    Erro Descupe Consute o Criador do Programa

  • password

    96848806

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c566cab0ddc02c5d42c2b814a4adfa30_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\c566cab0ddc02c5d42c2b814a4adfa30_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:684
    • C:\Users\Admin\AppData\Local\Temp\c566cab0ddc02c5d42c2b814a4adfa30_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\c566cab0ddc02c5d42c2b814a4adfa30_JaffaCakes118.exe"
      2⤵
      • Adds policy Run key to start application
      • Boot or Logon Autostart Execution: Active Setup
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:368
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe"
        3⤵
          PID:2980
        • C:\Users\Admin\AppData\Local\Temp\c566cab0ddc02c5d42c2b814a4adfa30_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\c566cab0ddc02c5d42c2b814a4adfa30_JaffaCakes118.exe"
          3⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:4944
          • C:\Windows\SysWOW64\install\SkYNet.exe
            "C:\Windows\system32\install\SkYNet.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            PID:3340
            • C:\Windows\SysWOW64\install\SkYNet.exe
              "C:\Windows\SysWOW64\install\SkYNet.exe"
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:2228
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 564
                6⤵
                • Program crash
                PID:3884
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2228 -ip 2228
      1⤵
        PID:1992

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 800a1abde9089aedea7bbc4bab429956f7b243fe3022e360f9bba7cab1c6e110
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 229KB
            • SHA256 a1d1b5ddfdd2ecf9317cae1ec137b2a2f8d9fa13e2ae7440c941764b4d6d57ca
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2b8283bcdb6c3734d36e31e220544a75c9a277619f979d0c60697a437b76a8bf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f054a7cee067036b6d506c58fd7a9915b5d1ee692ef375e0ed6b7a606805e04c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e40e09ef34a19e6b81553e72be15c5510403e7352b57714c6f523826afe628b8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 49a9785ff47187c1fd0d08d3cf4bc0c5992d32ec7220137b1498339b1dc5b046
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4f6692638af56fe3532f76cbe49ce19f0341eaaddd0a124af26e3c7151e01ae8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8f6d08be6106d5680d2c24363e9d4d1ec7eca3406ecb983d037abc8e37760e8b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fc3519fd609cd25b3d917f2beb969fa350d4979ed9cf7a72e36643dbbdc3d5c0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 96f6b53e2aaf81624984905f4dd082690046f03bee3e15ea0374aa4de6501c6a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d45d442b5e4812aecf91e856b66ef6e6dad3254f9f7fbf24ed7648d95dc79883
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eb372a33e6f2645b9a777bdda4af61d09ac069d3c52a304620d4ba4b9f1c1d03
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0261ee1773b12a03413cd75f74a34c5eebc5b54bdbb8fbd91be6392b435c7f57
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 346ff91a5cfb6425e2afcc9f1929b866e52d08c0b372468f8acdb3f2212a236a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 202bf239395ce04a8b30a56ba68f148e313992be1647e1756777c8c62344060f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e77efc6079a28508e6dbd62a597072bb07c097c82b16a4e841ffe43eb5f75d78
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2a3c895ac77256e4cee53a5ee25d99c753f41fe5b927a7f65c7f04dd45f22a21
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 17b0747fc5cdcb7d2a3a2744a099f33da4d036d8b7fa69a83d5d707f557b80ad
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 41f9209844d4f88f787d1d4748b11fd8e2b56a4089d9b0e89eee965b16902cf2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 51c58292b8fc2753b2bf36d867666ab2b00c8dc65e99799fd8cca8d7b3b9d7c9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 97bfbb50d1f534c361fe79b840e730b8712ff11008039ba465b9d6c00a3900f2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 89e2d566dbf12a1dd6e8adc3eb61552cbae024f69edf95f25ce973ba2c8732df
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c494021c7effaec77b5f7874cad14d24003fc0b2cace5a67ecd4646d5d871acb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c8d91e1e9dcd91700bb1b3b0ac36f7d1b1204c9dd6d980c4a1ee0b4818a66a95
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bc6e0b7272b10a48621ad5ac96f4aea1d31352a3094465eb3cdbca1921a62c1b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ecec366b29d59a2b1fd9f954f908daf17ad7ead3369ff7e70f72d8de61e0eb4a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f52986c0585de1b4f42441d83ae6be3b39f1707148ca462c2d70482be5accc69
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e32caf132edcae96a0165c9f9b76ffb983debd69f9a9ebce53c7d2ec6c331dcf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8fda6ee462c6dcd8ffe0f0d8c409d46988df34465ebd90b4ca4ca63199b72342
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1813ea2a49b138d2a833a04023cb278a5d64484b1129a5c44c87f2ce3bbd3b3e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3ed0359681dc3dde8adf6502c979f17fb14e4adfc0a0ae9242c26a1610a32e1d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 498732659b9c2ffa4602da7d0bef6218759099e08304760e13a8acf149d43c60
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c07dbc0934c6523ddd0d0716cb22bd0b6ee03e6a50b077c66fddc7ec8cd17b11
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5bf0b88044f02229b08c2df02b25e9f3d7337836996f94e918e2fc89c645bfe4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 74cf590716e48ed6207b8a680ffbcc6d91ab21612672f1c1e531eb10b0cb7153
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8b78adcab83a16dd2698e338bb0197a9b04420866f458879d878d2c81f8b7314
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 db8247bfee1c72c97088f193becd62d5e5cea7f93656b8ea51d9bbd7e99dcde5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 81d2450222268ef02c382eea1a04b52ed5464566925a190f1df42a9b2d9b81cd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9dd4de873bd08dd3509533a8b49bbad8edc8316fcd371f01f096acfad552df21
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 088a6f59cd96ad6c8a99a277d4e9833f161fe70bf59f37c8ddcb95d727b3f3a8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c95c04f97084e25322c54be194c02755a53fc98837ecafc261998bc11559381f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a7b41a417ddb41ec58c96172271048c1eab1575eea94b4c9368e0cb68389a596
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b7b9a647466169033458148560f04417690bef27afa8cd2c669015a7613597bc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 93c9c51b6d66955d4b052a618a1a3b7112c1b190ece9cb10de0791bb717ac229
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d2bcb7ce5b00405d090d82b6970a0a8559277c6cb7b268a225314e32a15f882e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 26522cca5ac7a66d619cb5e15357e58c5a549dd3db778255e709818815856761
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5961d875a09f2a264c46bb24f095a8a422a3495a378efe64776706c44f0c4bca
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b96a5eb9dc66779902448b48d414eef5a9c670fc1ec4188d0a3ad3b00be087cd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 31f1af1ebc2fbc8cd3c3da9205e4052680ccba2aec3e104e7f7c500affff705d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4dba7f388bda448b2f0ed742949bbc10f80b629542beb3021cda54b7b883bbc3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d7ab4662769fd49d031663d836d362ca3ffcb1960ca7d5c18331a04fc07db007
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 adeb7d27933841b9292c0bf1354bcfa02679be1fcd15c8fd789ed112cba9823e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2ef42edb17ab4589bf93e182881ecff80180bd020f68d03bfd2e3c62483551cd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b290a440ceb0a25dcc273bbd69b6e8448087c23b2844aad89fc41ff8399b8f98
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a3547ad30c0e78bddd3ca389d811c3dd6f0b2c5eb58a6f5dafacafc27a8a2f84
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b2dd340522c36f4d69fb3b1f80c2846f3744d836fd5289d4de8ec96d79fd6ef7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bb713dc4801226fbfe611b7ad8db97063b253c8f8678af3b17c87ea5279b9765
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c6b107b24739992b8114f04dc42386a12f905906387335fa8a60c5680c74b734
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 18435e59c906b171869bc5e7cd49ecfbce31121c39bc726e71fd11ca54589810
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 00e5b7538cd4e47bf539dd8e18a15d766afc5c24535f98fa3e61f59339533670
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c839da1c2687899195c1a6aeda6b65da682b6a48e4bb119616fc7b95ea5a2656
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cde75a4bb630f62b30ac367334bb1398cc845e8985a124c0932aee40aae38fbc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6b5d42413ab81087639ab3bc4ebda7a354510d4fa54685b13e34f7e0f681aa4f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d7fe246a842867ae86fd0887599bab5aea1c30ced46555d49598db3c58ccf905
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d6e216c3874d0ab6f2f5f59d50cc68700d82d183b990852ae3472f03328a85d4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e193925e075a532ff654867cd177a750439cbdfa7f4ea92659ff9fabaf6d0ca6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 284ee5ae44ca089789fd37b9c9f77ccd76e801a04f02a7719878b0387a35a34a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 87bd4a46e733d66f25805f9b57bfb11bb2f6139c49d798ffca9b4149d5711baf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 32e8499b5ee7fbb149b10b5b2141cabcf32d4697aa66130f94248657939db4e3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bb1905cc8ab9c500c4c3dbad08c0b3f7c061509381ca6894feb1708820a0baa9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 95b0466abe04d9be1e42b09247ade67694e413cbbdaff854d01317ef602b9875
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7f11a9b40044892bef29d4ec28287cb95dd70551cb2579a97baf732834ffc577
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ada83aa2ebed668e743c31bf879ab16747d7e9a3b9af840ab8514538b201af92
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1edbf6818724b0258a443f2678536e107382e79aad6fd204701c61dd9125224f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 33a1a06f4a37a4c9034f5beb3d8caaab94419836652fec1bd2f0eb2819694278
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 74bb9e6e43dd16db4570e72351c2ccca08438e53b68c4c7e086f04678bcc2d93
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1333652cd59bc7d33762aa519bda44730ec268414566425689b25a85a0e6bcb3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8f8bfc621954177910e1eb07a54c1bef58f593ede7e863365fef0f2cc171d8ab
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fc5935a4e94f1863b21d23e7d99f401c1449451bef9c8d8925c5b6049e5d54c6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4430b1c7af082ac1a3a7ef48418d5b83923e3eaea4627791f9676482926f1b4a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 355990c04c248786c68c82d02d9db01f8b843337852ee56559d8a7daf2706351
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7ab3f6ffced21205a98498c119b624daa12acf5690c6bad4cff5f845fbecd454
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ed061888f9b0d136a40c1f8c75e1476b0dfa88b92ce0b1340c5d0281527178ae
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f499fe98e812aca146c2062c395200ab16bc6c33a93b0dd824951c8f78ac3786
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 abe48c6be10e86fd97bf4fdb09fe9fc5cd057d6af4717036194e84b0f4839272
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 10d89417411eb0fe57359c61488a6d2546a9262c4c3c56bdb4956417931811f4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8bd5754af9da72313e5822bad3e6ac66f60b8e22f2f89e2c81326374357d83a9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0f5c619bc3638989bb470b7420b7861f23e1347ede060aff3b265f10f98ed6be
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 92aa8ecdbde9119551533aaafcb925dd3fe924e785a347ab95166e116217a380
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ad8dfe46568ca4ce13b548907713acd3043d8d3994bcac2334c9a7d12a22ec58
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8a96a96faeed5bc02a18914c2024ece10919bff9583ebd96eb9fc7f318d24020
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fbe1ec6e5b18f7fced8c8c486cc9c9db9bf630af43871537f20f00b799801858
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f268133e85afc7507e7f8b60e9a1bdf36434327677a8e4d54687fe4116f14967
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d56914abe13f6ce9422d3df35c0d455425a7fca775e863989a4c571002f6b0b1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a7314a086d255764c3d1a233a918cb9baa4e655f7bc740cc192fa17077d1cdc9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bbf7e1399f8784c9416c71b327b4a29c6db6a0eabfeb880a8f2a4f1f0fb9ee8b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d5a611a4e2e938f5d0db3cef0579fd0be136c3d2657699245324d704bebddd2c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0d8039f2056a7a3e19a3c986e4d07ad23f0c57bb548aaa45f0ab76c13ba94698
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9c9d2009febdb72ea7c545a97bdb339b1dad9414832cb217c8689986a41accff
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c867f314fa49dec58eba2dc696e7f6ff214a59acfdfd4742e67207b333a4cda7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 071402dd0b32b0aa0fa063d769168bdea9d2361dc1b6f406ce03bf30fcbc1abc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 695b3ae6bb778e31af195e337a3969ee837ad770d93c56e2b5cf6126dcf222fb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a5bd70f46c0c5e9b11a6a5c4fa6d807316c8a6769b84cdd154514107ac2de1c3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e3682dcf48869b0b84d685b428ad4511bfc46cbb8e4c7ed7a89750001d752294
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 56716a581a3d87dd2289521bcaf6c360a1480ad6df9e075b45dc688d4372847f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aaf689648da0e45eafad9feb64069bbb179814d6a0a51ecc7b2798606f735e4a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6e25c6190bcaeb8ee6825e0a0c6072226b3dd3876cdef0e00f6f9a8323f076f0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 366485f7b26b957a2a4296e74885ff145856f4c7fb48a1eb115ce019435201f2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b82140bd87320aef65b1cf33cef00b4ea4c1e506f313d7297f67b683ce91be2c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 75ae2b0d2b969f6bf6f6cef7fdb0719a2c739572e24f8101fcb34bc2fde75ee1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5968687047ab5cc1f4c569a41de060393f72f23cc00d41c475925dd005cb35c8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e7b0281b40c107cd275b2de6cca36d90eaa8cd17f6edb1de776be7deb3fae51c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3b52a68596397ca2e3ace42eacb0ea59cd3d4c440c45fc364d91a9ef69828f09
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 46c3242249fc1fb4fd20cbd552de70c1c6a4b9c086664d5d415b1bec86e67043
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1153a3c1d6905d88d3722de2539668958ec56286f0dc0f1b5ca77c286543c6a8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1ec01117707a5d90a1d0669b8e403d0f291e1e58fd5aece3a8c6bea55b0c0bd2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 991e4c9e26bc2d1c6a069bdb5c4343c0088d2c746e1d87063c71454627814dde
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d0e5cbd85d557527ea45daacd875f2fb6c1acdfc3a9289ba3f2321b0dc97a731
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 43a309333db8242beea6dbf102a53f9582936e2bd937a1cd7bd62c4aa0857b99
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e18d5238e1c16ddf322316e8ee6a353f71ea6951a72f7d9d483d46b891da982b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 78aee2def365a6166f3c0a203b77fb6567ad0117e5a081da0b9ff1a1dd0f4c85
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 43eb58cc2d9a5cf798f814debcb52801fd1eb3d8014660c0fa9117212959bf1e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ab5a0f3705562410693113400c9ca5daa6cb205ada62c2869377246eee78c358
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 88ec8d6ebb38cf619103b3e555e4304e20e21f7cc88da633d543dd111937bae8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2635faee60a9e74c096fe26b8a06c5af2a44d75838e5593a3c39d1b31a68f37d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b8aa877b9d8160e4bd6a9763d1851e14615a1dae365845c914d36f9ea11b435f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 114beb9f25147a052879bc84a376286b560db64264df49ed1548bce471440e6e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7101a6d148004da47e04ecec24cdc8227e38d6da040a4847cbc3511b18b0e298
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 66e5eb7ee6928a16af4403936dcf05e824c442bb487134b6de892ba5de335106
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0108810c38d76f2e59fc274339e54a161a6dde995af9bbe5e4ed612625716634
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d35d3d7a9c826da1def730d62bcbc73b08b22853102727c0f28aa4c933a8b0fb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8e347d8ad53a8616d9d16b8c9b7d273814a697e46f41b24c537bec49cb03850a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 360de1c531904716324ff3193cc962bf23f8057c50b67ca02435d6c59ce983c6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 164d35aa6cc588d4e519a04ba51f861a3f5efa3e0984b61b720bd403a7a0eefa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8048d1d11731bde4bf537133dd72d7c33455dfeccf282476ffbfdfc7e366e5ca
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1575a7fd0eaf3eb787db55354b3a3b6b66dd99614709ef6e2bf203899aa8cf5d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2ff61651b245b51b34c13176d4cb0102cd2734346090609b12e5d9bded158db4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ef79dae640d843ab71d727c603ca3de8bc6115dffd30f371aff2160bb8cb4161
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ae9953f21ece39d7aafd2199b062bdab262a783599ab79a8ce692920126d76dc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cd7b4e7bed776c50cc0aa6d94293c49fe22281882b26e12981830078c61841a3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1bda396ffe87abef4c96dc151bf1cea2e8e2c86a8df24ae3f3d89c6383974384
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
            • MD5 SHA1 SHA512

            SkYNet.exe

            • Path C:\Windows\SysWOW64\install\SkYNet.exe
            • Size 674KB
            • SHA256 2e4c502745e32f85cdb0e7fc76d2ba25126090ada54213f7fec082ff2bcb1587
            • MD5 SHA1 SHA512 SSDEEP

            memory/368-79-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/368-9-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/368-1-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/368-2-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/368-6-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/368-5-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/368-10-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/368-31-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/368-13-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/684-0-0x0000000000400000-0x00000000004E6000-memory.dmp

            memory/684-4-0x0000000000400000-0x00000000004E6000-memory.dmp

            memory/3340-107-0x0000000000400000-0x00000000004E6000-memory.dmp

            memory/4944-14-0x00000000000F0000-0x00000000000F1000-memory.dmp

            memory/4944-15-0x0000000000170000-0x0000000000171000-memory.dmp

            memory/4944-18-0x0000000000400000-0x00000000004E6000-memory.dmp