Overview

overview

10

Static

static

10

cedffca220...ed.exe

windows7-x64

10

cedffca220...ed.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    cedffca220aae5dfb50cd960825d7a29cf8b0fcac29ef090176c0e90fd37aded

  • Size

    883KB

  • MD5

    4659ef401743f34eeeb36cba62e9f25a

  • SHA1

    7ce863e1fad4f40a0a41674b163907a53eafbfd1

  • SHA256

    cedffca220aae5dfb50cd960825d7a29cf8b0fcac29ef090176c0e90fd37aded

  • SHA512

    a2d30fac67899356c1713300c33bbcc4771f8e9a3e44551c7ada8b47d5added2a127e58ecd1964306cf21a5e1a71d91db6eba821d2d2e471f45f8b428c06cae1

  • SSDEEP

    12288:tcD663BcaSZd0qQaQBO2h4nJtbP4MOF6x36SuF+SVkrARt7qn92zkPaCxZ:tIcaSZbQBan7be8pRARt7qn9Okl/

Score
10/10
fdpcybergate

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

fdp

C2

127.0.0.1:81

fnns.sytes.net:81
Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    true

  • ftp_directory

    .//maumar/Web/kl/

  • ftp_interval

    30

  • ftp_password

    fpnl39

  • ftp_port

    21

  • ftp_server

    maumar.com.br

  • ftp_username

    maumar

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    true

  • message_box_caption

    Algumas alterações só poderam ser vistar apos reinviar o exdb.

  • message_box_title

    Atenção

  • password

    fdp

Signatures

Files

  • cedffca220aae5dfb50cd960825d7a29cf8b0fcac29ef090176c0e90fd37aded
    .exe windows x86


    Headers

    Sections