Overview

overview

10

Static

static

10

2025-01-06...er.exe

windows7-x64

10

2025-01-06...er.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    06-01-2025 02:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-01-06_253baf4a712d3bacc42c2c944c688feb_darkgate_hijackloader_luca-stealer_magniber.exe

  • Size

    34.7MB

  • MD5

    253baf4a712d3bacc42c2c944c688feb

  • SHA1

    9c54c6810b05ad51f31a14acd60131dca259716e

  • SHA256

    35acdf1a5578a8605697cc8053509c51e8737921168f6f9917ba72d4e8bdc3ee

  • SHA512

    3cc204d205fc509ebc6b0857de825b1e4fc4c5b0478fe44bb3a0e97d4bed95e67878ebee824e3e69d94b663c0abf7c21c2a31021d4e30e788c7e5451111c4d91

  • SSDEEP

    393216:mXXdmf1JPPIbTv2zqfFOsvSqQs8yDuDhxMewmIaOiRrqNuZif8l1hSp0huAePYn6:Qw1JPGTvXfIsb45O8ZiY1s7g8Sw

Score
10/10
xredbackdoorbootkitdiscoverymacropersistencespywarestealer

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Signatures

  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred
  • Xred family
    xred
  • Downloads MZ/PE file
  • Suspicious Office macro 1 IoCs

    Office document equipped with macros.

    macro
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 7 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks for any installed AV software in registry 1 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Checks system information in the registry 2 TTPs 4 IoCs

    System information is often read in order to detect sandboxing environments.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 22 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 37 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-01-06_253baf4a712d3bacc42c2c944c688feb_darkgate_hijackloader_luca-stealer_magniber.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-01-06_253baf4a712d3bacc42c2c944c688feb_darkgate_hijackloader_luca-stealer_magniber.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2376
    • C:\Users\Admin\AppData\Local\Temp\._cache_2025-01-06_253baf4a712d3bacc42c2c944c688feb_darkgate_hijackloader_luca-stealer_magniber.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_2025-01-06_253baf4a712d3bacc42c2c944c688feb_darkgate_hijackloader_luca-stealer_magniber.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks for any installed AV software in registry
      • Writes to the Master Boot Record (MBR)
      • Checks system information in the registry
      • System Location Discovery: System Language Discovery
      • Checks processor information in registry
      • Modifies Internet Explorer settings
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:2332
    • C:\ProgramData\Synaptics\Synaptics.exe
      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2740
      • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
        "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks for any installed AV software in registry
        • Writes to the Master Boot Record (MBR)
        • Checks system information in the registry
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:1500
  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
    1⤵
    • System Location Discovery: System Language Discovery
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:2148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

3
T1112

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

4
T1012

Software Discovery

1
T1518

Security Software Discovery

1
T1518.001

System Information Discovery

4
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Synaptics\Synaptics.exe
    Filesize

    34.7MB

    MD5

    253baf4a712d3bacc42c2c944c688feb

    SHA1

    9c54c6810b05ad51f31a14acd60131dca259716e

    SHA256

    35acdf1a5578a8605697cc8053509c51e8737921168f6f9917ba72d4e8bdc3ee

    SHA512

    3cc204d205fc509ebc6b0857de825b1e4fc4c5b0478fe44bb3a0e97d4bed95e67878ebee824e3e69d94b663c0abf7c21c2a31021d4e30e788c7e5451111c4d91

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199
    Filesize

    854B

    MD5

    e935bc5762068caf3e24a2683b1b8a88

    SHA1

    82b70eb774c0756837fe8d7acbfeec05ecbf5463

    SHA256

    a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d

    SHA512

    bed4f6f5357b37662623f1f8afed1a3ebf3810630b2206a0292052a2e754af9dcfe34ee15c289e3d797a8f33330e47c14cbefbc702f74028557ace29bf855f9e

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
    Filesize

    1KB

    MD5

    1c3c3a439f6400df150a66b04100ab7b

    SHA1

    588b6fca2a794156f667893eb9547d7e0bfcfffa

    SHA256

    b4cb73b6230bd4737eeb672f6c982e2de6e9076ecdf0d2a19921b7f2f08f9772

    SHA512

    f4329ef97a8987ac9195ea89c3f48cf88635b2985f1eba6c6c5225c00e627ec422c03eaa112d5e3576109520be0bf4325e8d9976a8c191bfccb56f855c958f48

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AFF4C9FF97737D462CF50EC898BC7191_BC43DAD391BCDC812EDD5190FB536EA5
    Filesize

    471B

    MD5

    b53693044134a8ca0c1ab6f8dafd76aa

    SHA1

    af860bf27f299483b0bb4897f29e93a9763415a5

    SHA256

    94f30126ccfc56044a5afb106537e69803723f015f3e0840dce93d56023808be

    SHA512

    af8877df4090daf59bbe16c29e406ffea159d7df8ccb56c1bf5e90188bc654b347eb76c9b4cff0874e5d619e0799734deccac99f0e773d6e4d1ac53646ca7848

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
    Filesize

    471B

    MD5

    928ef8af7c167e1a1f495ec32806d23c

    SHA1

    b89bfa0b58b353e6989e09e996291bd5caf23040

    SHA256

    df2ddf87cf4f09af856ae95bcc11ef25a1a24700f6d76a7281e0005f9e4c59e8

    SHA512

    06ed382a217cda42e96bb588540f17b706c05c122417a1fb8c60faf17fe586b6c9610b299a5fb264f47f2ea5eb42b34fd00ff27735a8cfee7b8d63a52365a1e0

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E573CDF4C6D731D56A665145182FD759_AFB3BE9383420FBAFF24AD413EEA555E
    Filesize

    471B

    MD5

    2be0d2e5e52fe2fa24ffe155f3a0dd43

    SHA1

    d49f72d71ba4ad6263aa62458a4aa7dd967657a6

    SHA256

    552c7807b616aacb076347e44af70f044acf7baf4839831c44f12b490734b257

    SHA512

    4bc19353bac1f82cc542ab1fdc6d65d5bbd3a18cd6588625d355eb45d255dc9bd9cef4886f2648f094230ca8d03b3c1a978b6dac1c6e54055931974f0f24f9bd

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199
    Filesize

    170B

    MD5

    0ff5c1f1afa018d5dbc4b318d646729d

    SHA1

    1d2627e96860eebc8b9cdb5f971c424c996c60b3

    SHA256

    d22d4296329bfe060623a1ede89dad9cbcee9cd20e9869d312c25dc5d4ed17ec

    SHA512

    d34e4d1455ce15b72b597a39a7e349ef8205eb6a2c19d80a27b7e32f6f47bb3c7f29fd687ee92331ee2732a437fff56a74792a2cee1aba1829d24f6acc8e5504

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199
    Filesize

    170B

    MD5

    10326cd3c1b13c8b4b9cebdb5f74bfe7

    SHA1

    f6689c33014d174527f6c14fb9ff6ac24c1844ab

    SHA256

    93a1b92ea2674f947d9d03064ffc8b5eb4b2b6eb26c2f1f734c54cb8098221c4

    SHA512

    1095c586361f73429b73931900680daa97ba981e86b95def4a9c1aae462ba438bc95eb9dde05f1d624267b009b4ee4b4430afe0064092ee79ef7a1e8a6c0b056

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
    Filesize

    410B

    MD5

    82aa87c76cda832e3da7e8d827eb33a8

    SHA1

    e9e23f4d64bb273ba1f071f25d063d16ef0c5648

    SHA256

    9ff80f23b611a1598c22f6110f7e599f2da9a3782f362a3c04f0a44ff297d5fe

    SHA512

    322653bed0f0084bd38d530705fc97dbd0ec948f27357687d695f8a06029752e2e1377c65132354e5dd079389c2eb59ad70da3bc41b334a2f38a924e64d2217f

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AFF4C9FF97737D462CF50EC898BC7191_BC43DAD391BCDC812EDD5190FB536EA5
    Filesize

    414B

    MD5

    7eb330fda250d1a7e4c78f80210955a1

    SHA1

    b20c54612dc7d9ce3909e849985c918b9dfd7803

    SHA256

    38e1670dabe6cc01e864c6b703c2670e4bf8c9b971436d06345f843f9c065a7b

    SHA512

    c5068294b84282b85b06bb52b4c3aad30fe2853a3801824aecac09dd133965b12dcacad8b56735e7a40ab75da7cdeaaad86ff80f8dd2873e8980f355adfc7593

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
    Filesize

    400B

    MD5

    f9cb696abb076ca336d2706191f8ec3d

    SHA1

    2e8c27b27052244ef18760f414828175b0d33755

    SHA256

    85d2f69a682bc006878696d70c2713678a934050c2221012da49f903f1513b5d

    SHA512

    87e887f3b5011d3bcaa862f3e8b16e6fd7deea1c4cfe78ee69c34fed44edb3cd6a566a4ef54310f670c3f9bbacbc3aa2d5fe31a4b9097cdb96cb6757484d7307

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
    Filesize

    400B

    MD5

    f5f4a96f73e75c56d2f283d2ae277cc0

    SHA1

    e94b47dd3a2baf9dd5bc31e0cb49b067b126be6c

    SHA256

    3a1d664c9ea023e7d1dcdcffaf077b5aeb00a44a94999b1fb8908e7ac920a384

    SHA512

    b3824afbfc81856a4e7909e44d57b51e5baf4f7e1877378b7e85942bc4fae8df85375ec79ff1ad2e20d43b13b54538b9848f63258edae88496949b9e331d4e94

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E573CDF4C6D731D56A665145182FD759_AFB3BE9383420FBAFF24AD413EEA555E
    Filesize

    404B

    MD5

    cd792dcd9ac9aa01f537b8ac7c73345f

    SHA1

    23ba41bb761fe694a720a9f9bc5ea5b4d3e6cb61

    SHA256

    ca9a2dff5301b073c45b1c868181788f524e5f01854d3df55a9bb16451ebb7dc

    SHA512

    11c8f0845d53e86e3f5ae8aa36c6f60817ae04b98536cefb6ad5fcb6b00097dae24f4a9490269387d5c04c5a1d136ed0a012d52103d7e25b1173f04b6ff0276d

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\V01.chk
    Filesize

    8KB

    MD5

    8c20b879c0840fb90631c734ba08cf4c

    SHA1

    370cd81fa2b7ab6024385c678940341a3a64f6b6

    SHA256

    4e085ed04dc2b2cdca1d9582c8d0ecf72af46f889a0b9f43cccaf53e73af608a

    SHA512

    9323054220505a0bb004ab1d744e56fd538801f27b0c645806a85777679fd7f892a79fc17e39c1d223e578593d801fbbc03ec36afb6f3ff93eda9401a73c0168

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\V01.log
    Filesize

    512KB

    MD5

    46d9de6979eab6c1d55675ee906dbfea

    SHA1

    eab3544b1879344a40d6bafec167aaa443d607d7

    SHA256

    459b56d70157e5a500026a8418fbd7a630b127c71b9ba9931c0ed9fde762471e

    SHA512

    11d5a2abddc680ba8c496900b53e09cbe6337338d426f9f35525a2ececb42ba3dc66cc5b3d6be927d27f090c521f8c85c370721275832e7df7a0a85856787b8f

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\V01.log
    Filesize

    512KB

    MD5

    dee38dd0dd76cab661449b4a1c813400

    SHA1

    08fd3517f91e1c5e516259e088df7e283da8de22

    SHA256

    1357cf93ed957a93331c89976963179990dd709b0d05a78dc517d6f46407568c

    SHA512

    45eb20630853a62bd185bbc386a8908358f8ab67103e45a0b24b55643cd165344a99d0c0d06ac5fcdb46f1a7f3f0184038870ed555a82f96fdcbccb2b794ffac

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat
    Filesize

    20.1MB

    MD5

    2c12193c852e312b077527afc81e5685

    SHA1

    4475ddcdd86f1728cbf932e4a31f315a35097184

    SHA256

    a7a7e1aca1f09ff346e36334e9f6ffc81e8b0ae03b1c4daaec4ddd83eedcc275

    SHA512

    44952192b05d9a8500f7c59d54003099a6d99a07bfae2d97a35998829ebcceee6e169c240e5d2fb8305d6ef0bd65647296bdf9df0b4c055864f50db1e673b7da

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\CabCCE0.tmp
    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Setup\config.def
    Filesize

    48B

    MD5

    a7aae01415beba879259774ff60e4e07

    SHA1

    a169b7b90824154893ef8ca3ceb68483e794c118

    SHA256

    f79e0c02b2b3cfa15324e66531a4045c465ef3dcbd739a04b3e62d7977834479

    SHA512

    0539a6751bd2143906fda9c9aa89a09d9d448821512b719deecbe132921f4b190f6d1165176dd907d0a0157f85573f3a5726cb6d72e717aeeb101449f9cdf6d6

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\TarCCF3.tmp
    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\jKLbkShk.xlsm
    Filesize

    17KB

    MD5

    e566fc53051035e1e6fd0ed1823de0f9

    SHA1

    00bc96c48b98676ecd67e81a6f1d7754e4156044

    SHA256

    8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

    SHA512

    a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\jKLbkShk.xlsm
    Filesize

    24KB

    MD5

    0bcf05663e0284f5e6758b9eb9353b5b

    SHA1

    183a458772cf881e634e45ceb3166b65f88361a2

    SHA256

    fd013d6bae9a55cab17efa5b71bd7bfa1dfb84179c4c5abbe3ead6d52dd4dc67

    SHA512

    dcadc5bef8768454258dcf9f986ab3599689cb89aca415c50763ba90d5399cfa41619c3b1619432e62f93e907413ec3fa8b2a873d59ca42e9b997bfe466c9d31

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\jKLbkShk.xlsm
    Filesize

    21KB

    MD5

    db7ce68d3c96f4d478df7feb7b2bee1d

    SHA1

    eaaff8860ccaae86781e88761acdb521ad2454fd

    SHA256

    b94f5141089cdeab68c664e4f612cd5d11c9b6faa572046dab3b55dec8d790df

    SHA512

    67cfa9de5e0c0b1920244d2e3fe093cdaea6d427469438f87ec40a7f1d7f7d9db99473b1f75cd29182f1cd48e074d3da50d32e10d5b95a32d0f029f89f2eaed0

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\temp_ccupdate\update.ini
    Filesize

    149B

    MD5

    fdf179c828d56ad9ffe17cc51fde41b5

    SHA1

    7ebe7f576ece4781339b58f3ce2be4857455c499

    SHA256

    ee75bb143643edb2344d76f9058e4990e7ec3389714a7c796413b7ef1806b468

    SHA512

    f7cf168ff501556e97287db24bd025e25b66501ee7424d7e45ff95aa6ab956d772893df56504bb74c316aa9cfbf3aa85d0c05948fb9851c6cdd6d66b19380b96

    Download Submit

  • \Users\Admin\AppData\Local\Temp\._cache_2025-01-06_253baf4a712d3bacc42c2c944c688feb_darkgate_hijackloader_luca-stealer_magniber.exe
    Filesize

    34.0MB

    MD5

    06eadb849e2ee12b9420341705924c02

    SHA1

    10b23245275539577fd38669bfa0084a0579ee4d

    SHA256

    9267b511128b7a95c767f018a7954f80ace1d3e5df3682e691b38f83bd65fc28

    SHA512

    ebaefdc61c81c9f5870c6867cceb7ddbd9ff320a5dd9a950fb513142b433e741ee96f104aaa247968acf56db831b974e51f2bc7c9a1f7a01718622ea701e1aad

    Download Submit

  • \Users\Admin\AppData\Local\Temp\gcapi_17361302582332.dll
    Filesize

    600KB

    MD5

    f637d5d3c3a60fddb5dd397556fe9b1d

    SHA1

    66f0c4f137870a9927400ea00facc00193ef21e3

    SHA256

    641b843cb6ee7538ec267212694c9ef0616b9ac9ab14a0abd7cf020678d50b02

    SHA512

    e96984f2f9c6858e989f10fd8e71b09a8a640c9be2fb87ac1692d9bca7107d7a837f8fbdcc46c01a6107dd9020994c5a6f975b7e16434e9b2bf1c43b1f0d8b31

    Download Submit

  • memory/1500-50-0x0000000000130000-0x0000000000131000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1500-51-0x0000000004AB0000-0x0000000004AB1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1500-57-0x0000000004B50000-0x0000000004B51000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1500-56-0x0000000004B00000-0x0000000004B01000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1500-55-0x0000000004AF0000-0x0000000004AF1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1500-54-0x0000000004AE0000-0x0000000004AE1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1500-53-0x0000000004AD0000-0x0000000004AD1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1500-52-0x0000000004AC0000-0x0000000004AC1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2148-61-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2332-126-0x0000000005740000-0x0000000005748000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2332-109-0x0000000005BC0000-0x0000000005BC1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2332-65-0x0000000009160000-0x0000000009170000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2332-97-0x0000000005750000-0x0000000005758000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2332-129-0x0000000006050000-0x0000000006058000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2332-136-0x0000000005630000-0x0000000005631000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2332-131-0x00000000056E0000-0x00000000056E1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2332-117-0x0000000005630000-0x0000000005631000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2332-115-0x0000000005BC0000-0x0000000005BC8000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2332-71-0x000000000AC60000-0x000000000AC70000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2332-12-0x0000000000130000-0x0000000000131000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2332-13-0x00000000048C0000-0x00000000048C1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2332-19-0x00000000048D0000-0x00000000048D1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2332-20-0x00000000048E0000-0x00000000048E1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2332-21-0x00000000048F0000-0x00000000048F1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2332-22-0x0000000004900000-0x0000000004901000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2332-23-0x0000000004910000-0x0000000004911000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2332-24-0x0000000004920000-0x0000000004921000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2376-35-0x0000000000400000-0x00000000026C6000-memory.dmp

    Filesize

    34.8MB

    Download

  • memory/2376-0-0x00000000001C0000-0x00000000001C1000-memory.dmp

    Filesize

    4KB

    Download