cybergate | f87d454dd49c3b0c8bd81219f17b67c51056bfb45b6e60dc6eb9d9d5cbfb2594

Analysis

max time kernel
21s
max time network
9s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 08:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
f87d454dd49c3b0c8bd81219f17b67c51056bfb45b6e60dc6eb9d9d5cbfb2594.exe
Size 5.0MB
Sample260706-kf2a3acx3x
SHA256 f87d454dd49c3b0c8bd81219f17b67c51056bfb45b6e60dc6eb9d9d5cbfb2594
MD5 e7f1508efeef9a056d08dcdb04e1bc01
SHA1 ff0f0b445b24cb34b12a96dcaf42bc261f85eebc
SHA512 8f96c3b57a9a9d3edff7b058a03e3abd9f84581bc9d74e77b1f34ee609b12ca0e37a379082565a44c3d7d1ad3999a67e1fb580143f9db5439c797f118143a5cc
SSDEEP 98304:+xvXxO50HFx1J0oLjXIg5j/KbDqGA8PLle+EW8kd4+QXcqrGHuKLDP:+x/xO50PQqXIu/Mq7kle+pG+QsVH1D
TLSH
T1113633F0A61E277AD9C4CC3B52D12DA16CC2E5A6DBF4971B924AD37FC919E80C1106F2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

lab install aka seyhhd defense_evasion execution cybergate quasar xworm persistence rat spyware stealer trojan upx

Malware Config

Extracted

Family

quasar

Attributes

encryption_key
6D4A4249F385558E6764D6D6FE7C7D31F942200B
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
reconnect_delay
3000

Extracted

Family

xworm

uchiwa5.duckdns.org:8887
176.160.157.96:8887
monbondns.duckdns.org:8887

Attributes

Install_directory
%Temp%
install_file
jusched.exe

Extracted

Family

cybergate

Version

v3.4.2.2

Botnet

Lab install aka seyhhd

uchiwa5.duckdns.org:7777
176.160.157.96:7777
monbondns.duckdns.org:7777

Mutex

01YS4VXT0RVH7Q

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs
ftp_interval
30
injected_process
explorer.exe
install_dir
System32
install_file
dllhost.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
Remote Administration anywhere in the world.
message_box_title
CyberGate
password
cybergate92
regkey_hkcu
HKCU
regkey_hklm
HKLM

Signatures

Family: CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate
Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c69d-14.dat	family_xworm
behavioral2/memory/5656-28-0x0000000000A50000-0x0000000000A6A000-memory.dmp	family_xworm

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/files/0x00150000000118e8-7.dat	family_quasar
behavioral2/memory/5696-17-0x000002739F1A0000-0x000002739F366000-memory.dmp	family_quasar

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5224	powershell.exe
1472	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
5696	Client-built.exe
5656	jusched.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Power Settings 1 TTPs 8 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
3156	powercfg.exe
1184	powercfg.exe
6020	powercfg.exe
6156	powercfg.exe
7160	powercfg.exe
2344	powercfg.exe
984	powercfg.exe
3432	powercfg.exe

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4508-68-0x0000000010410000-0x0000000010480000-memory.dmp	upx
behavioral2/memory/4508-72-0x0000000010480000-0x00000000104F0000-memory.dmp	upx
behavioral2/memory/4508-79-0x0000000010480000-0x00000000104F0000-memory.dmp	upx
behavioral2/memory/4508-139-0x00000000104F0000-0x0000000010560000-memory.dmp	upx
behavioral2/memory/1760-143-0x00000000104F0000-0x0000000010560000-memory.dmp	upx
behavioral2/memory/2556-148-0x0000000010410000-0x0000000010480000-memory.dmp	upx
behavioral2/memory/2556-205-0x0000000010410000-0x0000000010480000-memory.dmp	upx
behavioral2/memory/1832-209-0x0000000010410000-0x0000000010480000-memory.dmp	upx
behavioral2/memory/1832-211-0x0000000010410000-0x0000000010480000-memory.dmp	upx
behavioral2/memory/1832-213-0x0000000010410000-0x0000000010480000-memory.dmp	upx
behavioral2/memory/1832-215-0x0000000010410000-0x0000000010480000-memory.dmp	upx
behavioral2/memory/1832-212-0x0000000010410000-0x0000000010480000-memory.dmp	upx
behavioral2/memory/1832-219-0x0000000010410000-0x0000000010480000-memory.dmp	upx
behavioral2/memory/1832-221-0x0000000010410000-0x0000000010480000-memory.dmp	upx

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1784	sc.exe
5028	sc.exe
1204	sc.exe
3492	sc.exe
4960	sc.exe
2724	sc.exe
6224	sc.exe
2764	sc.exe
4468	sc.exe
1976	sc.exe
6988	sc.exe
6460	sc.exe
3012	sc.exe
1264	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5628	4856	WerFault.exe	95

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5696	Client-built.exe
Token: SeDebugPrivilege	5656	jusched.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4256 wrote to memory of 5696	4256	f87d454dd49c3b0c8bd81219f17b67c51056bfb45b6e60dc6eb9d9d5cbfb2594.exe	89
PID 4256 wrote to memory of 5656	4256	f87d454dd49c3b0c8bd81219f17b67c51056bfb45b6e60dc6eb9d9d5cbfb2594.exe	90

C:\Users\Admin\AppData\Local\Temp\f87d454dd49c3b0c8bd81219f17b67c51056bfb45b6e60dc6eb9d9d5cbfb2594.exe
"C:\Users\Admin\AppData\Local\Temp\f87d454dd49c3b0c8bd81219f17b67c51056bfb45b6e60dc6eb9d9d5cbfb2594.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4256
- C:\Users\Admin\AppData\Local\Temp\Client-built.exe
  "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5696
- C:\Users\Admin\AppData\Local\Temp\jusched.exe
  "C:\Users\Admin\AppData\Local\Temp\jusched.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5656
- C:\Users\Admin\AppData\Local\Temp\update.exe
  "C:\Users\Admin\AppData\Local\Temp\update.exe"
  2⤵
  PID:5996
- C:\Users\Admin\AppData\Local\Temp\miner.exe
  "C:\Users\Admin\AppData\Local\Temp\miner.exe"
  2⤵
  PID:4828
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:6152
  - - C:\Windows\System32\wusa.exe
      wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:4264
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:1264
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:1784
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop wuauserv
    3⤵
    - Launches sc.exe
    PID:2764
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop bits
    3⤵
    - Launches sc.exe
    PID:5028
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop dosvc
    3⤵
    - Launches sc.exe
    PID:1204
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    3⤵
    - Power Settings
    PID:3156
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
    3⤵
    - Power Settings
    PID:984
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    3⤵
    - Power Settings
    PID:3432
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
    3⤵
    - Power Settings
    PID:1184
- - C:\Windows\system32\dialer.exe
    C:\Windows\system32\dialer.exe
    3⤵
    PID:3932
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "System"
    3⤵
    - Launches sc.exe
    PID:4468
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "System" binpath= "C:\ProgramData\System\System32.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:3492
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:4960
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "System"
    3⤵
    - Launches sc.exe
    PID:2724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\miner.exe"
    3⤵
    PID:1356
  - - C:\Windows\System32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:6780
- C:\Users\Admin\AppData\Local\Temp\server.exe
  "C:\Users\Admin\AppData\Local\Temp\server.exe"
  2⤵
  PID:4508
- - C:\Windows\SysWOW64\explorer.exe
    explorer.exe
    3⤵
    PID:4856
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4856 -s 76
      4⤵
      Program crash
      PID:5628
- - C:\Windows\SysWOW64\explorer.exe
    explorer.exe
    3⤵
    PID:1760
- - C:\Directory\Windows\System32\dllhost.exe
    "C:\Directory\Windows\System32\dllhost.exe"
    3⤵
    PID:2556
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      PID:1832

C:\Users\Admin\AppData\Local\Temp\update.exe
C:\Users\Admin\AppData\Local\Temp\update.exe
1⤵
PID:1440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4856 -ip 4856
1⤵
PID:6228

C:\ProgramData\System\System32.exe
C:\ProgramData\System\System32.exe
1⤵
PID:1968
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  PID:6084
- - C:\Windows\System32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:4956
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:6224
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:1976
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:6988
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:6460
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:3012
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  PID:6020
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  PID:6156
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Power Settings
  PID:7160
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  PID:2344
- C:\Windows\system32\dialer.exe
  C:\Windows\system32\dialer.exe
  2⤵
  PID:7012
- C:\Windows\system32\dialer.exe
  C:\Windows\system32\dialer.exe
  2⤵
  PID:3252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Power Settings

T1653

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

Admin2.txt

Path C:\Users\Admin\AppData\Local\Temp\Admin2.txt
Size 385KB
SHA256 06cfd012e4acce0f0cd9c0e02774bc6ac2623087b9b6bd7ed62f074562ec1991
MD5 60dc040d4edb31493b13a2f6504c8763
SHA1 9908367f8adbfd8efd4cecd46c0171045faa5773
SHA512 5f4188f43c9e08e26d61cf63ba7988a42f4a4439fbcc45c3d65e99a494628d16eff779dc52ad248769441f6c5603256b697e2e120c2751ce4a08c41d19fdc207
SSDEEP 6144:6A0nitqv/nHrHxVPGTZTzq9SkTr2m7mrUsqWBn837FNldObO3k1jh:6Bi8vvrHxVPKyv2m77sZB07FxObO32l
TLSH
T17C8423E4F03CAE861FD59B06273CEA80DBF86D379C934053499E761CE7AC1352B46661
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Admin2.txt

Path C:\Users\Admin\AppData\Local\Temp\Admin2.txt
Size 385KB
SHA256 a5dc65dfb3c39b5625738c13f80dcc102b5a89df4692d54c89fac5d5f9941cf5
MD5 06a1f78b7cf6de450650ead13b5d68ad
SHA1 237f3a003068e9242833d4f3d0b1905b63bbf9c4
SHA512 06393fad4478c9458adcbf8b4c71bfcf09dad296a5cd0bfb7473f6a47d9bab3f2671e0e2441ccf7687e44f15637a6510f17e36b2a2b824bc59b2df4fb436d6b6
SSDEEP 6144:YA0nitqv/nHrHxVPGTZTzq9SkTr2m7mrUsqWBn837FNldObO3k1jh:YBi8vvrHxVPKyv2m77sZB07FxObO32l
TLSH
T1F58423E4F03CAE861FD59B06273CEA80DBF86D379C934053499E761CE7AC1352B4A661
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Admin7

Path C:\Users\Admin\AppData\Local\Temp\Admin7
Size 8B
SHA256 b4fcc9101195d9e34c87b9a2fd8c80ff04557f50daa5d8852658f678c26c08d4
MD5 30dffd8b678463ed36699a2454961bb7
SHA1 1e4c9cd9dbb40b4e356aa1e306531cd04d112b1a
SHA512 1b537f32fd802b0d344ae236e7edd95609bae0bb9384d60f3615d2252cc87dc29748196ea3739b7c6aff7c2c817fc9d8db065e939977d25923ccf8d37f7fa6ac
MD5 SHA1 SHA512

Submit Download

Admin7

Path C:\Users\Admin\AppData\Local\Temp\Admin7
Size 8B
SHA256 40ab855cbd7127dbd857a873d56e8e886489984757aa82657cb124580e2b9f6b
MD5 83468d4a8cabf62eda4fbe650257b882
SHA1 d31228e803885b2f7dc38718ffa50c3bf9e5b9e8
SHA512 3825c3ecac055343fae75dc69793221a27a6f4151d8412e8ff0db12093fc4efd4b0cda76990fa0d3a2e840f04ebac5419ab7989d8bece7466076a84758c55e02
MD5 SHA1 SHA512

Submit Download

Admin7

Path C:\Users\Admin\AppData\Local\Temp\Admin7
Size 8B
SHA256 9628f8dd4bf3eedb7616cae7154e2ef84ce294553894e3a283a301d2efde60af
MD5 30a8bacb596d6c31ccbd80d979842b6b
SHA1 826e1e2702f414548431be31f4c7e10afff045e3
SHA512 33f7d2da5676cd23123836698be1e5c2fb5282832f409de48bbab4112f66a63648fce9ef9d6499d387ad7d04774a27a2c7304b9dffa8f991d8d36e4a724cbf81
MD5 SHA1 SHA512

Submit Download

Admin7

Path C:\Users\Admin\AppData\Local\Temp\Admin7
Size 8B
SHA256 9ffcd10c83b360f845853facd322e950f5e7c9c53b27a4c798555c7195c17482
MD5 e979c3e5ed44274a3640ca149f0c85ce
SHA1 881c74335911107f0b58554ae267cb67c47fee47
SHA512 a41518b3412266c4dc1d155e2307d48c7a10415b23224dbbc75dec31aac2cbf6a194be4517991a6fd3180591c1210355ed968dff3fb4dd1544c8d3c00b22c4c4
MD5 SHA1 SHA512

Submit Download

Admin8

Path C:\Users\Admin\AppData\Local\Temp\Admin8
Size 8B
SHA256 d9f18e4019f66802123a4b57618d9b8fb4742d2ed7bcc3ea9d4a3307cfcd5a98
MD5 736bd1988ef24171f1a2261da2c35309
SHA1 55b8560ebcbdef2a5507743b70a9b6a746496491
SHA512 3f37c8f5ca7660565af62ce430827bcc3fe1a1dd22a047edff34a76f7078974d5f661d2aa92080e16300242d37923d4a20e632036fb4335e256401f21eba12f7
MD5 SHA1 SHA512

Submit Download

Client-built.exe

Path C:\Users\Admin\AppData\Local\Temp\Client-built.exe
Size 1.8MB
SHA256 33f3a437dc54481b64c71431fd6192bcd703d768d61ef5579963afae04e74ecf
MD5 c321adf4a448a21fa28457c75c45a340
SHA1 790aaae537ca34b2d09df66a74d7a3bd49fffb2f
SHA512 73386471e3e5cb127cc3ba8ad0799965af13b4088dcb1b2ec3c93747d904c263a2af56fcd185506cbd4d35fdd2b8acbb111554cf361fd836620f473525e3cdda
SSDEEP 24576:hRbjQmqSKxJzck+7eWBRwRR16zA0KKm77yviUSQaZaOwI55l2S62r9cGW/yFoBk7:hxjQpTYj77wRGKKm77LrwCB6hqanq
TLSH
T196850250B7F98156E2BF2BB9B4B204460737F9439A3AC75F084850AD2EB7740DE913A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_3mws2t4y.gvw.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3mws2t4y.gvw.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

jusched.exe

Path C:\Users\Admin\AppData\Local\Temp\jusched.exe
Size 78KB
SHA256 410e3d6ec63b9287fd2e2e1b34321d391bc2f9dfc5169274e03dff6a0455eecc
MD5 6b58e2eba0f0b733e0010c326464c9ac
SHA1 9f636754a1825a9b752c1a0810e75ce29ccced89
SHA512 094ce28506106f3b3951b2f4eadf346d2abf470634da792f0960ccd6fe6cf7b3fe4a6f5034246852b444e03f01347245e0e6a267c8e006b83fabe2974ac41b39
SSDEEP 1536:hbO+kn9NC+Lzcx3H3K2bkD5P3d6MEQfKdrO0TsFb2nMN:hbO+Q/odbkD9/PIO0xMN
TLSH
T1DF736D6C77E5042AE0FFAFB05CF23252C779F6536902D60F24C9069B6A23A84CD916F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

miner.exe

Path C:\Users\Admin\AppData\Local\Temp\miner.exe
Size 2.7MB
SHA256 90245f1a83c588643402419d8fe15916fc5348dde89e85a359f6b080321e262e
MD5 08e9868657289f14b391650fa1ee0efe
SHA1 253b9892b3eb6b5ddd2b377ca45b20f52b614926
SHA512 e9855d2eb388f1b5dd378869bef5745306d8baeb119ff8bb11f4424301f94e1e3638546716862f3e57887013450cad197132828859b2d459c53f7879e98e3818
SSDEEP 49152:H7jGuWkOqGCwu1M22Hbtz1whzBv99AS7n56F22caVIo690T6KqzXZKnCw+23EX:bozpx22Zz1kviEUFcaVIo690+5zJKnxC
TLSH
T185D5335961946ADDC624F93A61354A6068F734ADCFF0A2DBEDC3AF32F46C4E12633160
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

server.exe

Path C:\Users\Admin\AppData\Local\Temp\server.exe
Size 428KB
SHA256 846e2d9f71840c5a6ae1573ef48154905edea161c156802fbad8a3abe8834a2d
MD5 81363d69f1af04ab55428b9896465ff4
SHA1 e51db9daa604dc5b28c9c2c35eb702831f4be459
SHA512 e55a5bcaae87f04a6637c35d730474b0882656c404f98d315de32475f81f4910514d35191b097bf478553b2f8929a814b649b413efefdac28c476c4a27828f7d
SSDEEP 12288:BuMwqBi8vvrHxVPKyv2m77sZB07FxObO32C:BHwj8vrx52t07FQa1
TLSH
T16D9412A6F4555C77DBA18AFC1D2CD684EB6D3E222C27509399FD3F88C71C262260D1A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update.exe

Path C:\Users\Admin\AppData\Local\Temp\update.exe
Size 11KB
SHA256 d6966099c5998c8fdabf3f7f435856b469a1cefd4c8f8362c2dceebe7dd31c94
MD5 8001a5a10f6f71e5b93703afad23f8aa
SHA1 bb3350de5a04c8c48efdb9e7ebeb30826c37ce9a
SHA512 63e180b64e6d152226127bc636671919173018c50ce408281dddf36a4b90e07263e21d4976795dae7ab054819415124cf6b3227b1725c138be2bab51286debec
SSDEEP 192:DWnbgb7kBSaox8bjIdclNRNxhbmq82MgXw+yJOxMjR8/MY1BZ:ibgbJaPfNrxhmq82MgXw+yYxU8/BB
TLSH
T15E32C741B3E882A6E67B8F36587217110672FA1AAC23CF5E0CCD601D5D777D01A23F66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1472-685-0x0000022D268D0000-0x0000022D26982000-memory.dmp

Download

memory/1760-142-0x00000000045E0000-0x00000000045E1000-memory.dmp

Download

memory/1760-143-0x00000000104F0000-0x0000000010560000-memory.dmp

Download

memory/1832-213-0x0000000010410000-0x0000000010480000-memory.dmp

Download

memory/1832-219-0x0000000010410000-0x0000000010480000-memory.dmp

Download

memory/1832-209-0x0000000010410000-0x0000000010480000-memory.dmp

Download

memory/1832-215-0x0000000010410000-0x0000000010480000-memory.dmp

Download

memory/1832-212-0x0000000010410000-0x0000000010480000-memory.dmp

Download

memory/1832-221-0x0000000010410000-0x0000000010480000-memory.dmp

Download

memory/1832-211-0x0000000010410000-0x0000000010480000-memory.dmp

Download

memory/2556-335-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/2556-205-0x0000000010410000-0x0000000010480000-memory.dmp

Download

memory/2556-148-0x0000000010410000-0x0000000010480000-memory.dmp

Download

memory/3932-573-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/3932-574-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/3932-576-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/3932-575-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/4256-18-0x00007FFC97520000-0x00007FFC97EC4000-memory.dmp

Download

memory/4256-66-0x00007FFC97520000-0x00007FFC97EC4000-memory.dmp

Download

memory/4256-0-0x00007FFC976AF000-0x00007FFC976B0000-memory.dmp

Download

memory/4256-29-0x00007FFC97520000-0x00007FFC97EC4000-memory.dmp

Download

memory/4256-8-0x00007FFC97520000-0x00007FFC97EC4000-memory.dmp

Download

memory/4256-2-0x00007FFC97520000-0x00007FFC97EC4000-memory.dmp

Download

memory/4256-1-0x00000000000E0000-0x00000000005E6000-memory.dmp

Download

memory/4508-68-0x0000000010410000-0x0000000010480000-memory.dmp

Download

memory/4508-72-0x0000000010480000-0x00000000104F0000-memory.dmp

Download

memory/4508-146-0x0000000000400000-0x0000000000471000-memory.dmp

Download

memory/4508-79-0x0000000010480000-0x00000000104F0000-memory.dmp

Download

memory/4508-139-0x00000000104F0000-0x0000000010560000-memory.dmp

Download

memory/4856-74-0x0000000000D00000-0x0000000000D01000-memory.dmp

Download

memory/4856-73-0x0000000000C40000-0x0000000000C41000-memory.dmp

Download

memory/5224-427-0x000001B72E050000-0x000001B72E072000-memory.dmp

Download

memory/5224-483-0x000001B72E3C0000-0x000001B72E3CA000-memory.dmp

Download

memory/5224-470-0x000001B72E300000-0x000001B72E3B2000-memory.dmp

Download

memory/5224-465-0x000001B72E2E0000-0x000001B72E2FE000-memory.dmp

Download

memory/5656-28-0x0000000000A50000-0x0000000000A6A000-memory.dmp

Download

memory/5696-34-0x00007FFC97520000-0x00007FFC97EC4000-memory.dmp

Download

memory/5696-51-0x00007FFC97520000-0x00007FFC97EC4000-memory.dmp

Download

memory/5696-50-0x00007FFC97520000-0x00007FFC97EC4000-memory.dmp

Download

memory/5696-48-0x00007FFC97520000-0x00007FFC97EC4000-memory.dmp

Download

memory/5696-17-0x000002739F1A0000-0x000002739F366000-memory.dmp

Download

memory/5696-37-0x00007FFC97520000-0x00007FFC97EC4000-memory.dmp

Download

memory/5696-45-0x00007FFC97520000-0x00007FFC97EC4000-memory.dmp

Download

memory/5696-35-0x00007FFC97520000-0x00007FFC97EC4000-memory.dmp

Download

memory/5696-19-0x00000273A1130000-0x00000273A115E000-memory.dmp

Download

memory/5696-62-0x00007FFC97520000-0x00007FFC97EC4000-memory.dmp

Download

memory/5696-30-0x00007FFC97520000-0x00007FFC97EC4000-memory.dmp

Download

memory/5696-61-0x00007FFC97520000-0x00007FFC97EC4000-memory.dmp

Download

memory/5696-76-0x00007FFC97520000-0x00007FFC97EC4000-memory.dmp

Download

memory/5696-33-0x00007FFC97520000-0x00007FFC97EC4000-memory.dmp

Download

memory/5696-32-0x00007FFC97520000-0x00007FFC97EC4000-memory.dmp

Download

memory/5696-31-0x00007FFC97520000-0x00007FFC97EC4000-memory.dmp

Download

memory/5996-52-0x0000000005550000-0x000000000555A000-memory.dmp

Download

memory/5996-49-0x00000000054A0000-0x0000000005532000-memory.dmp

Download

memory/5996-47-0x0000000005B90000-0x000000000614A000-memory.dmp

Download

memory/5996-46-0x0000000000AC0000-0x0000000000ACA000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads