Overview

overview

10

Static

static

10

2c651bcbad...e8.exe

windows7-x64

8

2c651bcbad...e8.exe

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    2c651bcbad672c5fecc0f86eef024adf2389ddb6b61f24083721f657453d53e8

  • Size

    298KB

  • MD5

    5293fd9727ca3734ced4a3fe47afe33b

  • SHA1

    77c396e669dd75246c69ca32e29de325e3aad05f

  • SHA256

    2c651bcbad672c5fecc0f86eef024adf2389ddb6b61f24083721f657453d53e8

  • SHA512

    c71a46a87facd3fad5f6cefb076a5807dcf2315dbed4d9e84efe02dfc504a81c3e40b02713037a27019eb6a0782f8b7e5e365c7648b46697b46a87048b81cc73

  • SSDEEP

    6144:YScrHn4mp8D6WGc/YSlIipBReubLzeh7Yy0DMIdeXijyb:pccy78QSVnNyhsFMCeSjy

Score
10/10
6a7aehcybergate

Malware Config

Extracted

Family

cybergate

Version

v1.18.0 - Crack Version

Botnet

6a7aeh

C2

127.0.0.1:288

mr-maxim.no-ip.info:288
Mutex

C5HV3826B6M0JD

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    Steamr.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    1478963

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

Files

  • 2c651bcbad672c5fecc0f86eef024adf2389ddb6b61f24083721f657453d53e8
    .exe windows x86


    Headers

    Sections