Overview

overview

10

Static

static

10

29a7bbd2c1...cc.exe

windows7-x64

10

29a7bbd2c1...cc.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    29a7bbd2c16383efab7271ad33fd9a6145cf571c0f45be6cc7334fda51bdc3cc

  • Size

    287KB

  • MD5

    1d4b43b876883e092295260db9e89490

  • SHA1

    25f24a8807cfee4ad2919e3c490972fa6391cefd

  • SHA256

    29a7bbd2c16383efab7271ad33fd9a6145cf571c0f45be6cc7334fda51bdc3cc

  • SHA512

    cc702eacdb1f437df1bad9d2612fcc8462e61775ba1284eb9928be17534e179fd0397a41619d3aede2f12c6e4ce97174e1ec93b79bfff15a5e401ef20c3d34c8

  • SSDEEP

    6144:WmcD66RRji5JGmrpQsK3RD2u270jupCJsCxC0:DcD6637Z2zkPaCxZ

Score
10/10
vítimacybergate

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

vítima

C2

plow.no-ip.org:5000

Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    hkcmd.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    Windows

  • regkey_hklm

    Windows

Signatures

Files

  • 29a7bbd2c16383efab7271ad33fd9a6145cf571c0f45be6cc7334fda51bdc3cc
    .exe windows x86


    Headers

    Sections