Overview

overview

10

Static

static

10

e0048cbfc8...8f.exe

windows7-x64

10

e0048cbfc8...8f.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    e0048cbfc8b210f06cbc8d615f74172dbae05eaa285b0452c0de1356d2324d8f

  • Size

    428KB

  • MD5

    663677d9d782d70b522c2701a906c040

  • SHA1

    03175ab583621bf0ea59e0aeb47bc42686a3a7d6

  • SHA256

    e0048cbfc8b210f06cbc8d615f74172dbae05eaa285b0452c0de1356d2324d8f

  • SHA512

    e947bffd68ea28ffa869ba8882b49d60101754126ebf25e6ddf3ec3f6b0243d7deca39ee9a9b0f6240a700a5dd148bc97ed846243fcc12c2981aec6d70f5389a

  • SSDEEP

    12288:xuMwuBi8vvrHxVPKyv2m77sZB07FxObO32U:xHwX8vrx52t07FQaJ

Score
10/10
slavecybergate

Malware Config

Extracted

Family

cybergate

Version

v3.4.2.2

Botnet

Slave

C2

bengt1337.zapto.org:200

Mutex

H865DE5V60B164

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    Java

  • install_file

    Java.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    kattsand123

  • regkey_hklm

    WindowsUpdate

Signatures

Files

  • e0048cbfc8b210f06cbc8d615f74172dbae05eaa285b0452c0de1356d2324d8f
    .exe windows x86


    Headers

    Sections