General
-
Target
7cee20404dcd952f8c36eba29f9efe59b5a0436535738490cd99d06f29100034
-
Size
283KB
-
MD5
a112a43523f7b5981e9585cf3c2019b5
-
SHA1
3992f859f60ac4edabec22a0267e4c3642e5bb6c
-
SHA256
7cee20404dcd952f8c36eba29f9efe59b5a0436535738490cd99d06f29100034
-
SHA512
e092a939feb9ae8af42b64147ad68ca5078119b18443acf3d7eae016e669430d588ad939ae8d3733a2ef356bec4d64a5754391aefbfd6a03520fc7c5da8a1d4b
-
SSDEEP
6144:04ABF94npAuO/50BTnZZsPhhFBHNijYp2+HYNMi7/nJjT:LUtGLZWPDt4YE+H+T7JT
Score
10/10
Malware Config
Extracted
Family
cybergate
Version
v1.05.12
Botnet
Toledano
C2
microsafe.redirectme.net:1025
spamfighter.serveblog.net:1025
Mutex
AYRFB63B4RCE3Q
Attributes
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
Derive
-
install_file
Derive 5.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
AVFuck3
-
regkey_hkcu
Derive5
-
regkey_hklm
Derive5
Signatures
-
Cybergate family
Files
-
7cee20404dcd952f8c36eba29f9efe59b5a0436535738490cd99d06f29100034
Headers
Sections