Overview

overview

10

Static

static

10

b66e7f803a...5a.exe

windows7-x64

10

b66e7f803a...5a.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    b66e7f803ad123959d5658a7df3a4142fab01a8d6b1b83dac278811e8329d15a

  • Size

    402KB

  • MD5

    7be1e4b54e9e3672f68bfaaa1aafd1d8

  • SHA1

    d0c12247e28651f3be16d8c331646d97f84fb65a

  • SHA256

    b66e7f803ad123959d5658a7df3a4142fab01a8d6b1b83dac278811e8329d15a

  • SHA512

    fec2f9c670bef69aac2bff98c870ed9b5baa30f51af7b1057a84d6840105bc144f00281811ce5d882601e9339bdf06a29b7261cc448db1fb21fab42b01795512

  • SSDEEP

    6144:H4ABFTGQ3pAuO/50BTnyZsSaXhh4XAS79hO9R0O91FG+OIgJwLui:YUNwGLyWSKaAS79MEqfGhv

Score
10/10
upxremotecybergate

Malware Config

Extracted

Family

cybergate

Version

v1.05.1

Botnet

remote

C2

host101.no-ip.biz:82

Mutex

70P1N345218E26

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    windows-kb890830

  • install_file

    mrtstub.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    73967396

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • Cybergate family
    cybergate
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx

Files

  • b66e7f803ad123959d5658a7df3a4142fab01a8d6b1b83dac278811e8329d15a
    .exe windows x86


    Headers

    Sections