Overview

overview

10

Static

static

10

f8d5430ef6...04.exe

windows7-x64

10

f8d5430ef6...04.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    f8d5430ef68db80ac6a83b6668b9c9aa994d3f44cdea445a968a3ab4431aae04

  • Size

    290KB

  • MD5

    639ea866a81cc0d0af70dac6f5f4fdd1

  • SHA1

    89088e2f07ea2422efaa6f6e7712558f289cb76a

  • SHA256

    f8d5430ef68db80ac6a83b6668b9c9aa994d3f44cdea445a968a3ab4431aae04

  • SHA512

    72d1e2222714f198c83543b3ccd02a76a817c3b247dff55c319347c96b517e809cad93252387877e58067c8a83b60aaf1fb08cb2736f67921dec0cfe4450b7ff

  • SSDEEP

    6144:2OpslFlq3hdBCkWYxuukP1pjSKSNVkq/MVJbL:2wslaTBd47GLRMTbL

Score
10/10
5478cybergate

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

5478

C2

127.0.0.1:100

kellox.no-ip.org:100
Mutex

0A80MGHL8K774M

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    kellox

  • regkey_hkcu

    WindowsUpdate

  • regkey_hklm

    MicrosoftUpdate

Signatures

Files

  • f8d5430ef68db80ac6a83b6668b9c9aa994d3f44cdea445a968a3ab4431aae04
    .exe windows x86


    Headers

    Sections