Overview

overview

10

Static

static

10

4291323074...48.exe

windows7-x64

10

4291323074...48.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4291323074571e4dddac6b9df1abbef3f24e59ba5038148415f46888d4347648

  • Size

    233KB

  • MD5

    63f155cbbbe48e2ab39ba0f32d755580

  • SHA1

    d862f7365a61c821ffe9d848c4a1574382cd4a01

  • SHA256

    4291323074571e4dddac6b9df1abbef3f24e59ba5038148415f46888d4347648

  • SHA512

    ae585b4a27dccc7c93d8edc08c0d2f1ab9c6b986313eba1e1a406ce3c559747199668c2672febbc660890aec7cb38b4315288aa14bed1ff65c212567d78dc3f1

  • SSDEEP

    6144:aDLLqQE13DSrEC34W1MlfzKgBvGAaQ0d0ji:aDLLRC3DwpOfv2d0u

Score
10/10
upxvítimacybergate

Malware Config

Extracted

Family

cybergate

Version

2.5

Botnet

vítima

C2

yopliz.no-ip.org:80

Mutex

masjek

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    oscar

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • Cybergate family
    cybergate
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx

Files

  • 4291323074571e4dddac6b9df1abbef3f24e59ba5038148415f46888d4347648
    .exe windows x86


    Headers

    Sections

  • out.upx
    .exe windows x86


    Headers

    Sections