Overview

overview

10

Static

static

10

48a66a3022...58.exe

windows7-x64

10

48a66a3022...58.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    48a66a3022f530ef2369ed54b68ecf3ddfb9ee46ed46bb3fc5bdd0d0c5c4d958

  • Size

    284KB

  • MD5

    b21abe480a28f67b9ccf0d279425beda

  • SHA1

    54d529f7bc62e7c68fbba758e1f085d42c23d08d

  • SHA256

    48a66a3022f530ef2369ed54b68ecf3ddfb9ee46ed46bb3fc5bdd0d0c5c4d958

  • SHA512

    9ac6cae45292a986f53fe624f2c4e8eb89a2a08c463bf4456947b2afe13c0e6d4024eba5721d5e096c19c8edabc318ef9821a3b68aeb3d4cdec628657ebe7800

  • SSDEEP

    6144:Lk4qmfIIsgaUvDpGSyt6GoXXKsTCAot3ChlvP3Z5zA4o1rE3h:w9g+UvNG3imAotShlXPWQx

Score
10/10
upxöííécybergate

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

ÖÍíÉ

C2

ninga-japan.no-ip.org:81

Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    svchost.exe

  • install_file

    windows.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

Signatures

  • Cybergate family
    cybergate
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx

Files

  • 48a66a3022f530ef2369ed54b68ecf3ddfb9ee46ed46bb3fc5bdd0d0c5c4d958
    .exe windows x86


    Headers

    Sections

  • out.upx
    .exe windows x86


    Headers

    Sections