Overview

overview

10

Static

static

10

42023cd16f...e8.exe

windows7-x64

10

42023cd16f...e8.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    42023cd16f839fa9a87d782916a76ce8ddf2319f57f0fa1b7efe156b12d284e8

  • Size

    352KB

  • MD5

    1fb63bdf0025d28ee704b1b840503108

  • SHA1

    5194ebf84610e5aa10573d72e8b75decc3c2ddde

  • SHA256

    42023cd16f839fa9a87d782916a76ce8ddf2319f57f0fa1b7efe156b12d284e8

  • SHA512

    b9efbb9ef47c544c69d59267609f32a81f437f9ebda65b88ddb88a395b5fc00cb09cd3a57f73ee2c298810a580883118f56242fe502b055b17afb0521da65081

  • SSDEEP

    6144:DmcD66R/5JGmrpQsK3RD2u270jupCJsCxCXISpfR:6cD66MZ2zkPaCxGB

Score
10/10
upx123cybergate

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

123

C2

nlive.no-ip.biz:12

Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    svchost.exe

  • install_file

    windows.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • password

    123

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • Cybergate family
    cybergate
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx

Files

  • 42023cd16f839fa9a87d782916a76ce8ddf2319f57f0fa1b7efe156b12d284e8
    .exe windows x86


    Headers

    Sections