cybergate | 2c08ff6a35203fb39f4f01b267d2e37ee7d3858114b90c0e5a676c24ef19cb7c

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
09-10-2024 03:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe
Size

2.4MB
MD5

2a0eac4a29193e4974fc62d0563132c8
SHA1

56fa794365db835a07d66a58f8b9b3e245b351eb
SHA256

2c08ff6a35203fb39f4f01b267d2e37ee7d3858114b90c0e5a676c24ef19cb7c
SHA512

719b749e1a95762ccacf153cf8bd3f81d20c31e8f42842d397c6c9c50f6664e1d21f227033a013214c435b497335557cd09507c29cb8206c5bde5eae26b50f23
SSDEEP

49152:bS6CjZMSsu5Ky1MzzgfnpNYyrODlP7expD+ger3NKwmBIMJ/4xieOi3klBhCE2:b0jZMSsu5ziiXeZ7exp1C3NBPMJ/4xVL

Score

10^/10

cybergate vítima discovery persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

vítima

ghost77.no-ip.biz:81

Mutex

***MUTEX***

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
spynet
install_file
server.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
texto da mensagem
message_box_title
título da mensagem
password
abcd1234
regkey_hkcu
HKCU
regkey_hklm
HKLM

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\spynet\\server.exe"	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\spynet\\server.exe"	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

Processes:

2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exeexplorer.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{08B0E5JF-4FCB-11CF-AAA5-00401C6XX500}	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{08B0E5JF-4FCB-11CF-AAA5-00401C6XX500}\StubPath = "C:\\Windows\\system32\\spynet\\server.exe Restart"	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{08B0E5JF-4FCB-11CF-AAA5-00401C6XX500}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{08B0E5JF-4FCB-11CF-AAA5-00401C6XX500}\StubPath = "C:\\Windows\\system32\\spynet\\server.exe"	explorer.exe

Executes dropped EXE 2 IoCs

Processes:

SpyNet.exeserver.exe

pid	Process
2356	SpyNet.exe
1668	server.exe

Loads dropped DLL 4 IoCs

Processes:

2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe

pid	Process
440	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe
440	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe
440	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe
440	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\spynet\\server.exe"	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\spynet\\server.exe"	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe

Drops file in System32 directory 4 IoCs

Processes:

2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe

description	ioc	Process
File created	C:\Windows\SysWOW64\spynet\server.exe	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\spynet\server.exe	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\spynet\server.exe	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\spynet\	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2116-0-0x0000000000400000-0x00000000006CE000-memory.dmp	upx
behavioral1/memory/2116-317-0x0000000000400000-0x00000000006CE000-memory.dmp	upx
behavioral1/memory/2136-548-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral1/files/0x00360000000194ef-551.dat	upx
behavioral1/memory/2116-881-0x0000000000400000-0x00000000006CE000-memory.dmp	upx
behavioral1/memory/440-880-0x0000000000400000-0x00000000006CE000-memory.dmp	upx
behavioral1/files/0x0006000000019604-903.dat	upx
behavioral1/memory/2356-913-0x0000000000400000-0x0000000000957000-memory.dmp	upx
behavioral1/memory/440-916-0x0000000006960000-0x0000000006C2E000-memory.dmp	upx
behavioral1/memory/1668-920-0x0000000000400000-0x00000000006CE000-memory.dmp	upx
behavioral1/memory/2136-1968-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral1/memory/1668-1990-0x0000000000400000-0x00000000006CE000-memory.dmp	upx
behavioral1/memory/2356-1992-0x0000000000400000-0x0000000000957000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exeexplorer.exe2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exeSpyNet.execscript.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SpyNet.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

SpyNet.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SpyNet.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	SpyNet.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe

pid	Process
2116	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe

pid	Process
440	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe

description	pid	Process
Token: SeDebugPrivilege	440	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe
Token: SeDebugPrivilege	440	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 7 IoCs

Processes:

2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exeSpyNet.exe

pid	Process
2116	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe
2356	SpyNet.exe
2356	SpyNet.exe
2356	SpyNet.exe
2356	SpyNet.exe
2356	SpyNet.exe
2356	SpyNet.exe

Suspicious use of SendNotifyMessage 6 IoCs

Processes:

SpyNet.exe

pid	Process
2356	SpyNet.exe
2356	SpyNet.exe
2356	SpyNet.exe
2356	SpyNet.exe
2356	SpyNet.exe
2356	SpyNet.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe

description	pid	Process	procid_target
PID 2116 wrote to memory of 1196	2116	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe	20
PID 2116 wrote to memory of 1196	2116	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe	20
PID 2116 wrote to memory of 1196	2116	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe	20
PID 2116 wrote to memory of 1196	2116	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe	20
PID 2116 wrote to memory of 1196	2116	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe	20
PID 2116 wrote to memory of 1196	2116	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe	20
PID 2116 wrote to memory of 1196	2116	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe	20
PID 2116 wrote to memory of 1196	2116	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe	20
PID 2116 wrote to memory of 1196	2116	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe	20
PID 2116 wrote to memory of 1196	2116	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe	20
PID 2116 wrote to memory of 1196	2116	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe	20
PID 2116 wrote to memory of 1196	2116	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe	20
PID 2116 wrote to memory of 1196	2116	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe	20
PID 2116 wrote to memory of 1196	2116	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe	20
PID 2116 wrote to memory of 1196	2116	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe	20
PID 2116 wrote to memory of 1196	2116	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe	20
PID 2116 wrote to memory of 1196	2116	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe	20
PID 2116 wrote to memory of 1196	2116	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe	20
PID 2116 wrote to memory of 1196	2116	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe	20
PID 2116 wrote to memory of 1196	2116	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe	20
PID 2116 wrote to memory of 1196	2116	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe	20
PID 2116 wrote to memory of 1196	2116	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe	20
PID 2116 wrote to memory of 1196	2116	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe	20
PID 2116 wrote to memory of 1196	2116	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe	20
PID 2116 wrote to memory of 1196	2116	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe	20
PID 2116 wrote to memory of 1196	2116	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe	20
PID 2116 wrote to memory of 1196	2116	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe	20
PID 2116 wrote to memory of 1196	2116	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe	20
PID 2116 wrote to memory of 1196	2116	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe	20
PID 2116 wrote to memory of 1196	2116	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe	20
PID 2116 wrote to memory of 1196	2116	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe	20
PID 2116 wrote to memory of 1196	2116	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe	20
PID 2116 wrote to memory of 1196	2116	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe	20
PID 2116 wrote to memory of 1196	2116	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe	20
PID 2116 wrote to memory of 1196	2116	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe	20
PID 2116 wrote to memory of 1196	2116	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe	20
PID 2116 wrote to memory of 1196	2116	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe	20
PID 2116 wrote to memory of 1196	2116	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe	20
PID 2116 wrote to memory of 1196	2116	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe	20
PID 2116 wrote to memory of 1196	2116	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe	20
PID 2116 wrote to memory of 1196	2116	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe	20
PID 2116 wrote to memory of 1196	2116	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe	20
PID 2116 wrote to memory of 1196	2116	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe	20
PID 2116 wrote to memory of 1196	2116	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe	20
PID 2116 wrote to memory of 1196	2116	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe	20
PID 2116 wrote to memory of 1196	2116	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe	20
PID 2116 wrote to memory of 1196	2116	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe	20
PID 2116 wrote to memory of 1196	2116	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe	20
PID 2116 wrote to memory of 1196	2116	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe	20
PID 2116 wrote to memory of 1196	2116	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe	20
PID 2116 wrote to memory of 1196	2116	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe	20
PID 2116 wrote to memory of 1196	2116	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe	20
PID 2116 wrote to memory of 1196	2116	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe	20
PID 2116 wrote to memory of 1196	2116	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe	20
PID 2116 wrote to memory of 1196	2116	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe	20
PID 2116 wrote to memory of 1196	2116	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe	20
PID 2116 wrote to memory of 1196	2116	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe	20
PID 2116 wrote to memory of 1196	2116	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe	20
PID 2116 wrote to memory of 1196	2116	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe	20
PID 2116 wrote to memory of 1196	2116	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe	20
PID 2116 wrote to memory of 1196	2116	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe	20
PID 2116 wrote to memory of 1196	2116	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe	20
PID 2116 wrote to memory of 1196	2116	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe	20
PID 2116 wrote to memory of 1196	2116	2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe	20

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1196
- C:\Users\Admin\AppData\Local\Temp\2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe"
  2⤵
  - Adds policy Run key to start application
  - Boot or Logon Autostart Execution: Active Setup
  - Adds Run key to start application
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2116
- - C:\Windows\SysWOW64\explorer.exe
    explorer.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - System Location Discovery: System Language Discovery
    PID:2136
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:352
- - C:\Users\Admin\AppData\Local\Temp\2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2a0eac4a29193e4974fc62d0563132c8_JaffaCakes118.exe"
    3⤵
    - Loads dropped DLL
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:440
  - - C:\Users\Admin\AppData\Local\Temp\SpyNet.exe
      "C:\Users\Admin\AppData\Local\Temp\SpyNet.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:2356
    - - C:\Windows\SysWOW64\cscript.exe
        
        "C:\Windows\system32\cscript.exe" "C:\Users\Admin\AppData\Local\Temp\teste.vbs"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2052
  - - C:\Windows\SysWOW64\spynet\server.exe
      "C:\Windows\system32\spynet\server.exe"
      4⤵
      Executes dropped EXE
      PID:1668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Language\Default.ini

Filesize
14KB

MD5
ee9826fd3883b9756896baed5d076cc6

SHA1
d1c829cabcb967410e03489723d9e51b9549d6f6

SHA256
e06ff3e2b4cf78d6147d00dbfd00066751d1d6680b3dd672e861574741a894d9

SHA512
404cfe3632fc3614a0e686504a2edcdf984aab20afc8fc4c7785d76bd52bf466078e756838c2ce5350439ad128756e55e1c3b12f3badd70fba8e74d171a05538

Download Submit
C:\Users\Admin\AppData\Local\Temp\Settings\Settings.ini

Filesize
1KB

MD5
448a49c2d7253c927e820056e9e7ea8b

SHA1
c7171c7b597beea4bb584319ddac80eadee5d3be

SHA256
afcc1b53d0e2ef177754d4f6ae9ab391e7115e39fc73caaabcb3cd585c2e4c7c

SHA512
54dc9c1eba0154aa648ec317c51642fd88d7dcd50b4e5f1eea5c67e1c7db91a7e8cb97d0b538e4a280d91a65fea8baa888734960fbf636b7067ac407840a5224

Download Submit
C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt

Filesize
2.3MB

MD5
55bb672269156b92f037e5655f2a3ba5

SHA1
a8e6fa12f2bb254c6868ff260a2c80e7ef997292

SHA256
99a4ade0b349757ca342f1179a8d4ca3208c1e08cbaf936fb54d49f5f4f9041c

SHA512
e750ef7676010e932c652fd014d9058de45a04d81b2a642c91b104839ce0bd62817c951e80ee88f91126feab48e87172d25aa6750b54866a9409466649f50658

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
2d9be3c21160dd5835dc913eb1c90e37

SHA1
824aa594c31ad121be72e998e1c340499ff498d2

SHA256
b535294b36a15bc17e24f62cbbba57691e6b9e31a4403e12f251dda158a69d8b

SHA512
0912f04b383309aec27e540f850ae90915383f0c8e6840b8440462a0faad62d6c8e80a87e1d991834a01ec448e8dbc3487f51fa75a6623ced91475fe34ad77fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
ed4edfb49301f579e0f687bcc5010151

SHA1
4ca4d37332329e25f005c8e1cb4f743e2e91bea6

SHA256
e3d9e38713aadfe60d91fbaea2d4b36ab48ef35d64971e11a6ebe62cf64c07b7

SHA512
8d71fcd1984f6c66518cc4cf8443b72c068c26b646f453dc157408443020d85397e72d3948b6cf12c8ea1d67a628bede762bc9324fa0532d138b04cbd5108c0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
b119fabcafe3193d5d7273b93b6b7563

SHA1
874bd7bb4b35d5ddf09aebcc781e910dacbfe1ec

SHA256
3e2e842b1fb2aace90b248da7d7143a2a855046ba3566ac54dfbf8514a042521

SHA512
81c2addeeb491a8c20ec8e3844b76b2200c4adb2417539a0469e586e44630b3ea5a0c1cf346dee9eaee94b303be345532f35fbcc7cd8f2a7cecf47ca1c8054f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
41c385d70171235446ce0e51420a9ff9

SHA1
6ca779771acd4ac3440f0e2151cbfc391e4b6219

SHA256
55f759e17a6807eb8b583460c5cbceb144acb73c29a4c18e6d9636e629644af6

SHA512
87c5f1c6892f4616111ee1a8b1de20df01a7f6dc5cc3dcf02ff5358617a23423cdbeb181411a820997860693da0170018a1ea2d92295c2eef42b0400610809fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
8f3121b1a3eb0143c0911d90a1348f08

SHA1
1178a4d62909bd3ec9aa6d3a860a9a1a3ce31c20

SHA256
cac4127113e1fa7b4908a1aeeb9cb808b7fd68a9c9d73a16b9f05524ffdb7db8

SHA512
9506b959af3aaecf25ad558d4c6214b206ff982edac8c5d1982fe472865a4cd5f3f412e5aa7f21c668e17319004af06a35e77c8773f2401ae7760931d5218d81

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
34ccbc2c519d160ff5831af8f3be69a4

SHA1
4099c6b91bd2044112eb53751332c3533b64d29f

SHA256
331876866d58b7c6076d32836a856ae6a1ec32e4d459122b53dcd5031433f219

SHA512
aefb08b1deb14bc84abcecbbe813899d39145db1f0066c6ce0cbea25a3f37714fce8417303cf344560a6f0ac400eaf7c08e10f6494d065f8f879d0147e4fa5ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
eb77c41e99f0db7d928517d1bc233748

SHA1
d36c90816c7f4c786cc2af4d57855a8412cf6ced

SHA256
e3f934800814fd760bf8efc22216501f666de7a61669437273143d099c894672

SHA512
8875457c90f939f2ac785a6eff9a3ece2529b6be9fc7628d6256d8422bad543824c20e0f29a91f32787cf526efbbb4631ddd9db18fbe66d781c6fbb631c2c59c

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
9926424f86204623ec235867b779c8bf

SHA1
c62f08a96319675edb4f63d11e601044e6ab4d91

SHA256
abeb895e75f1ac18ff4e81d0b65c4758f54361ed9d34766978a2889ed9a992be

SHA512
a4117bb59699f3820aa0e7f710f0d653e1276f85d23f945dc67a5cd4460875f3830a33c95a0909765b1934e52ac72fc2f90317558b12c4a0cc80a48f666f2acf

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
6107d34da7473f488a009ad1c37ecb08

SHA1
69d5ba8dd5f80608957bc6df1935bec956e9fc54

SHA256
007e20b84e8d6d1c85c5148607761abd08383ea226508995d4310aaf7594f4a4

SHA512
8cbfdc03db5296b24e4a482ffb8940791eeba3756d9b90dc15ee138fa807a8e5791c584a185b6b7aa1072586816a3d512bbd29638f9186036a8d268e0d05b443

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
7132332ce259730d0de5b08b13152974

SHA1
f288c0f78910501053e02185df5ed8086ca39342

SHA256
2a2a6c6de3f244a1a22c50c2eaa18d9158767006b97aa98f0a8ee6fad662fa4c

SHA512
dbde653b0fcd6cc17c54514e1ca6547d59a3f28cf42d9b36c2e69eaabd25bf4d464b6a750fd5eab9d1de54aa11ee117466e3e1be6164b48818547999485d4fe5

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
d9f28e79c8fac6ff2fa576bff7baf8ef

SHA1
a4933957818a228cda8ed8c5b40079de3dd81d5c

SHA256
dee6fd4f6fb2b8893182b315f860998e1a56a9400e6e07333120dcb7eefe6f9f

SHA512
623e5b193d1bde0693171628bb104d8b46bcbd875d61411827f09b43157e020253bfff1429bc9918466d062c85c5e638a096aad5bb19ca674e74fd669c14386d

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
9a60986632a317435f509c883670609c

SHA1
7d9e85bfc4fb6018b3bb57a34338519424199675

SHA256
35c1cceefdba19eb34e0377621477068916a8ffd63de9bf10772fe8f0222500a

SHA512
fa7f25da242f3aaa87e3fe4fe581784cfeba01e55e8b4fc3eb9e6917910c16179ece158cfba90d61381abfbc8aed83ddb65e968d50ce894a0aac9c431cdbc459

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
a28eaac1c12363ccbc93ad2904943ef1

SHA1
ceb2a20ce148163bcbcc15e6237bea75308f0f5d

SHA256
ec492453dc86d6b4bb3150a84349dbb408bb7341384abde25310132ed506d12d

SHA512
0910dba356bcb7a10bc720548be0e6b451d2a5b026d03520795f340fcf4475f13b3c1a5330ec20ce5482c7a51b86f9f74a3e6b2478677b6e002db9f0c6acd410

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
86d851c5bd6bbe331507ee41b1208522

SHA1
a03c6fdfbe34acc80d360538667e20b9b71c082c

SHA256
534e9c8fc956c4880da666bcc170206baa3682335223ed9efa81b048aac182c7

SHA512
4d2c6067f2fa1326188f076ae3c59d5032247f20d2d08516970860e8a0a4b8785295f117ebcd7554e85f366e55c283f78153f8e230aa2e76400945f8d14808fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
68812969e25e2913b47ab32894294569

SHA1
d4f25597976c0a42ecc08de9da6a5d9aca2ca3c3

SHA256
2b0161d5583d7b0180fafbc6de5ce6ed40d0b5db80399bbc678e2b72a3d710be

SHA512
72756609dd4cf4c506d327898671aa8ccff9d05ad9a3fbd1aa81f3f2f334c0713136d8ff6d8552cc8d2b66f939df3e4c06fc1aad219109d9a33328dbb213eb7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
a8b50f8067a27f4a0e43a1d6f6d30092

SHA1
d47fb0ac2ce2f1a4ac457d57ad0ffb29b07e7b1b

SHA256
3039295eae27edb2323a3681a79a20621bc7f1c7cd9b7594a18423ea15471ed8

SHA512
84aae7eed17792b8256fad378612e17c3382b0882cc9b821b4f0676a40787047f144efa2d30a8cee23742f6e0d2d4d3be722aa313b0f96bc78d5d720480429ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
d4c48c72f9b4c098e8b11aaa1e94b6af

SHA1
b2533bc64cc0ce79417c5700e51698903439de85

SHA256
2e263adaf2b9d53cb249f44daa3a261674a841f19548222af34e8ad282bfb025

SHA512
c92c1ee15a7e6b2e4cb9237bc7bd53da3b2cfa1240f4076f2880c9dcdaa4582a68ffeb834b0550c027ecc81a3166a5fa0a3dbb89d869bc913335893351918cb1

Download Submit
C:\Users\Admin\AppData\Local\Temp\XxX.xXx

Filesize
8B

MD5
bc6aeec2759df7702e04147d60cbef72

SHA1
902ce79dbdfc3abe670524d62c3a6ef770906a4c

SHA256
8cc1d5e9d58b1d04cf686b82ccc6e0d325e792a7ed58fbd7a952725407bc5477

SHA512
04b46c16ba9dc263517a1a7fcbe084db77a60511cc57bdadf0c53ac6a46407d33a9419928eba2fe3b231489bd14db37485001a629d778f5221c3de40179a432b

Download Submit
C:\Users\Admin\AppData\Local\Temp\teste.txt

Filesize
2B

MD5
81051bcc2cf1bedf378224b0a93e2877

SHA1
ba8ab5a0280b953aa97435ff8946cbcbb2755a27

SHA256
7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6

SHA512
1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\teste.vbs

Filesize
841B

MD5
615964e5ab63a70f0e205a476c48e356

SHA1
292620321db69d57ba23fa98d2a89484ddcf83d0

SHA256
38a2c0e90a7c86eb5355710dd205f22f84dbba59e688cd3da6394af8c924a102

SHA512
69886825baf2075f8e6cdc50b0b34f92d5d06d42db4586396fb3db806fef79986ba5754c7b1251b007cde4f943efe9e3d27800dd7e15f8084fd7e7e6046c3ccc

Download Submit
C:\Users\Admin\AppData\Roaming\logs.dat

Filesize
15B

MD5
e21bd9604efe8ee9b59dc7605b927a2a

SHA1
3240ecc5ee459214344a1baac5c2a74046491104

SHA256
51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46

SHA512
42052ad5744ad76494bfa71d78578e545a3b39bfed4c4232592987bd28064b6366a423084f1193d137493c9b13d9ae1faac4cf9cc75eb715542fa56e13ca1493

Download Submit
C:\Windows\SysWOW64\spynet\server.exe

Filesize
2.4MB

MD5
2a0eac4a29193e4974fc62d0563132c8

SHA1
56fa794365db835a07d66a58f8b9b3e245b351eb

SHA256
2c08ff6a35203fb39f4f01b267d2e37ee7d3858114b90c0e5a676c24ef19cb7c

SHA512
719b749e1a95762ccacf153cf8bd3f81d20c31e8f42842d397c6c9c50f6664e1d21f227033a013214c435b497335557cd09507c29cb8206c5bde5eae26b50f23

Download Submit
\Users\Admin\AppData\Local\Temp\SpyNet.exe

Filesize
2.0MB

MD5
98de7bcad1ba2caf74007bd97bc2b505

SHA1
8a79d06159a339313b810f23835b8417429dd356

SHA256
e4b3b3e72bd3bf4052a3136cb811ea54923bc2d7807709992e0345743d49ced8

SHA512
ef57cc4f0ad4bf1f54baaf7213bf868c418eebfb0eee3c32ff376b67d5d5337c35a94a1418951d82aae371820ce37eade7cf0a74ce54a4198e18327bd232a35d

Download Submit
memory/440-912-0x00000000067C0000-0x0000000006D17000-memory.dmp

Filesize
5.3MB

Download
memory/440-1993-0x0000000006960000-0x0000000006C2E000-memory.dmp

Filesize
2.8MB

Download
memory/440-1991-0x00000000067C0000-0x0000000006D17000-memory.dmp

Filesize
5.3MB

Download
memory/440-880-0x0000000000400000-0x00000000006CE000-memory.dmp

Filesize
2.8MB

Download
memory/440-1972-0x00000000067C0000-0x0000000006D17000-memory.dmp

Filesize
5.3MB

Download
memory/440-910-0x00000000067C0000-0x0000000006D17000-memory.dmp

Filesize
5.3MB

Download
memory/440-919-0x0000000006960000-0x0000000006C2E000-memory.dmp

Filesize
2.8MB

Download
memory/440-916-0x0000000006960000-0x0000000006C2E000-memory.dmp

Filesize
2.8MB

Download
memory/1196-4-0x0000000002A40000-0x0000000002A41000-memory.dmp

Filesize
4KB

Download
memory/1668-920-0x0000000000400000-0x00000000006CE000-memory.dmp

Filesize
2.8MB

Download
memory/1668-1990-0x0000000000400000-0x00000000006CE000-memory.dmp

Filesize
2.8MB

Download
memory/2116-317-0x0000000000400000-0x00000000006CE000-memory.dmp

Filesize
2.8MB

Download
memory/2116-881-0x0000000000400000-0x00000000006CE000-memory.dmp

Filesize
2.8MB

Download
memory/2116-0-0x0000000000400000-0x00000000006CE000-memory.dmp

Filesize
2.8MB

Download
memory/2136-1968-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/2136-548-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/2136-271-0x0000000000010000-0x0000000000011000-memory.dmp

Filesize
4KB

Download
memory/2136-260-0x00000000000A0000-0x00000000000A1000-memory.dmp

Filesize
4KB

Download
memory/2356-913-0x0000000000400000-0x0000000000957000-memory.dmp

Filesize
5.3MB

Download
memory/2356-1992-0x0000000000400000-0x0000000000957000-memory.dmp

Filesize
5.3MB

Download