Overview

overview

10

Static

static

10

a1763d2a22...90.exe

windows7-x64

10

a1763d2a22...90.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    a1763d2a22d08b13f13d7b95a1be8f9bcddd72b3bf0a204bd746c61a5d195390

  • Size

    363KB

  • MD5

    6eed5d6fe5215eaa144728487a94abc0

  • SHA1

    b2b91c8433497a7bbf84e8f4a6caeb593d5eca30

  • SHA256

    a1763d2a22d08b13f13d7b95a1be8f9bcddd72b3bf0a204bd746c61a5d195390

  • SHA512

    e46eb4cfcb8e9bd35a2948b28a00048b6223c79311d422f7cfb81b161bf682a793be3803879464a9f13f154dae5e13a8dcc30c7ccf88aae9826b5c330807aac0

  • SSDEEP

    6144:8OpslFlq2wK9wKHMswKHMKhdBCkWYxuukP1pjSKSNVkq/MVJbQ:8wslJzmsmKTBd47GLRMTbQ

Score
10/10
ayadcybergate

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

ayad

C2

ayadd19.no-ip.org:1990

Mutex

3YSAB5G07EABS8

Attributes
  • enable_keylogger

    false

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    system

  • install_dir

    windows

  • install_file

    windows.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    123456

  • regkey_hkcu

    HKC

  • regkey_hklm

    HKL

Signatures

Files

  • a1763d2a22d08b13f13d7b95a1be8f9bcddd72b3bf0a204bd746c61a5d195390
    .exe windows x86


    Headers

    Sections