General
-
Target
caa00c01472d615bda4509e02ae743ff2693eb249ed971f964f8802c77561ae2
-
Size
273KB
-
MD5
27638e293feea1c3232807fb92b6ee81
-
SHA1
5ed8e3ddd168b61b0ace2db20e772f2afaee6636
-
SHA256
caa00c01472d615bda4509e02ae743ff2693eb249ed971f964f8802c77561ae2
-
SHA512
dd6ed7ebd6c19e36226a6ceda354a91b032bdb006e727c21268291d5ea7de41b1dcab5ac4160fbb5a7b4dd0f852ee6d7c3fd038c8c2e9fc4c4b52579433eccd9
-
SSDEEP
6144:P3LZvsxZZQttyCVxaWYSdMU/77hlruc6XmDoTbcI7CPPdx:v1eAtpVxagMU/plruchDofAPb
Score
10/10
Malware Config
Extracted
Family
cybergate
Version
v1.02.0
Botnet
cyber
C2
127.0.0.1:82
Mutex
SB52SV0Y2C1Q5P
Attributes
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
csrss.exe
-
install_dir
Winbooterr
-
install_file
Svchost.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
456456
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
Cybergate family
Files
-
caa00c01472d615bda4509e02ae743ff2693eb249ed971f964f8802c77561ae2
Headers
Sections