Overview

overview

10

Static

static

10

501f24e3db...c9.exe

windows7-x64

10

501f24e3db...c9.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    501f24e3dbd8e7c91da8f1b23ecb5d58bb2c4a348440afab79185b34235b61c9

  • Size

    289KB

  • MD5

    7c2530ec821bb2351f952c6f9f4f2f1b

  • SHA1

    462c851c2cfac059141041bce4890c191eed4b45

  • SHA256

    501f24e3dbd8e7c91da8f1b23ecb5d58bb2c4a348440afab79185b34235b61c9

  • SHA512

    da4e1a63f9dc1a78a100fac4dabf46c430d203be481f70a0bbf6adf5f951bb0e19b5eccbb3d3312bb2d51d35cbe0076a05d79046371f59fb2fe7e1b74da75724

  • SSDEEP

    6144:eOpslFlqMhdBCkWYxuukP1pjSKSNVkq/MVJbl:ewsl/TBd47GLRMTbl

Score
10/10
ashiqcybergate

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

Ashiq

C2

pinkpanther30009.no-ip.biz:100

Mutex

OX031S322GK77A

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    winDir

  • install_file

    Svchost.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    123456

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

Files

  • 501f24e3dbd8e7c91da8f1b23ecb5d58bb2c4a348440afab79185b34235b61c9
    .exe windows x86


    Headers

    Sections