Overview

overview

10

Static

static

10

f1f522846a...a0.exe

windows7-x64

10

f1f522846a...a0.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    f1f522846a679f10e2e321d4c0b82252413d9fbdf1fa86c5daeae04b1c4d66a0

  • Size

    277KB

  • MD5

    68a226d2b1b1e7d7d92eb8ea52405630

  • SHA1

    46abe926e1cd75bb6174e8e37a079335deca6aae

  • SHA256

    f1f522846a679f10e2e321d4c0b82252413d9fbdf1fa86c5daeae04b1c4d66a0

  • SHA512

    7258e5b490021d5e584051110cc658bb7881af1d64e439c872ab7046fea6e9b3ec3fbb7ba524ef2fac636e1fe83fc24ac788e5762a1b2b43673d6f60dcaa1f0d

  • SSDEEP

    6144:HyuMwiLdfT2m7mrUsqWBn837FNldObO3k1jA:SuMwk2m77sZB07FxObO32E

Score
10/10
remotecybergate

Malware Config

Extracted

Family

cybergate

Version

v3.4.2.2

Botnet

remote

C2

sever21.no-ip.org:81

Mutex

OK5MO8KYJQHYNO

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs

  • ftp_interval

    30

  • injected_process

    svchost.exe

  • install_file

    wininit.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    cybergate

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

Files

  • f1f522846a679f10e2e321d4c0b82252413d9fbdf1fa86c5daeae04b1c4d66a0
    .exe windows x86


    Headers

    Sections