Behavioral task
behavioral1
Sample
d89116803c66920bfc2a286507c8becd675af259b42290babf2051ee637031bf.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d89116803c66920bfc2a286507c8becd675af259b42290babf2051ee637031bf.exe
Resource
win10v2004-20220812-en
General
-
Target
d89116803c66920bfc2a286507c8becd675af259b42290babf2051ee637031bf
-
Size
687KB
-
MD5
9095f4129ebc67e492bc6800aa3d2179
-
SHA1
3ed0e1675fac7a0e3db450c7a5aa7e0f4372dda8
-
SHA256
d89116803c66920bfc2a286507c8becd675af259b42290babf2051ee637031bf
-
SHA512
f8a742acdb933a83528944582f84900b1ada265a2bbe8c8f0c0418baca0fd42620168fd071da0323598f31efdd49584f1ff546ed7ffe61a656e28895239fc3a6
-
SSDEEP
12288:WcD663fkpQ4dLOSwCDfJqlE6uGiGSAlVLuBRzXA2oAMHVB66EYAUTS9D/ksSzQRr:WkkDLtwCc26uGi2VCHXSBzTaDMsAQRr
Malware Config
Extracted
cybergate
2.7 Final
philippe
romain38.no-ip.org:81
***MUTEX***
-
enable_keylogger
true
-
enable_message_box
true
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
Windir
-
install_file
svchsot.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
La réinstallation de se logiciel peut résoudre les problemes.
-
message_box_title
Erreur System
-
password
123
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
Cybergate family
Files
-
d89116803c66920bfc2a286507c8becd675af259b42290babf2051ee637031bf.exe windows x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 44KB - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 1024B - Virtual size: 544B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 8B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 634KB - Virtual size: 633KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ