General
-
Target
af32d85844469d72b0bee86e3a9bc4f987f11dc3068677cfe1377a0b5662e322
-
Size
278KB
-
MD5
92480019f5426961f64b31284e8c3dd0
-
SHA1
a91b3730ddc0a23b317b58eb755b408e2cdf5db4
-
SHA256
af32d85844469d72b0bee86e3a9bc4f987f11dc3068677cfe1377a0b5662e322
-
SHA512
70dc45202244ae50d77e6755a5f40e8643b50df34fea36f7c1324ff0c65071dfe68d4f2fd35a09471746c1c7d2c88fe909825be0501dfcc83465582d744b75fe
-
SSDEEP
6144:KxJsGLnxFoxDNT/xQphU+jrlgzfuzt91C9NDyWId98HhqbxtHGZ2:0JsGdF4h/xQp6+tqOYy9zo09
Score
10/10
Malware Config
Extracted
Family
cybergate
Version
v1.02.1
Botnet
Lammer
C2
127.0.0.1:81
hnqc.ddns.net:81
Mutex
"MUTEX"
Attributes
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
Install
-
install_file
System32.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
VOCÊ FOI HACKEADO ...SEU SISTEMA SERÁ FORMATADO.
-
message_box_title
LAMMER
-
password
123
-
regkey_hkcu
System32
-
regkey_hklm
System
Signatures
-
Cybergate family
Files
-
af32d85844469d72b0bee86e3a9bc4f987f11dc3068677cfe1377a0b5662e322
Headers
Sections