Overview

overview

10

Static

static

10

98f15e0efb...60.exe

windows7-x64

10

98f15e0efb...60.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    98f15e0efbc8200302d05d540d67f52c14d515f988db2b4f67796bab60213760

  • Size

    604KB

  • MD5

    4c45b100d23d440677999461c637b8dd

  • SHA1

    22c5953bad5eaf025a51f1d2c9a86ef4c85ecbed

  • SHA256

    98f15e0efbc8200302d05d540d67f52c14d515f988db2b4f67796bab60213760

  • SHA512

    35fc434a62d43736e6b06de7b328783447290931b5357ad6ea7ee25144312d5ad6911869b8c6180978da8b3827ce1d620edefc877c397b667b6a67931ecd64c3

  • SSDEEP

    12288:WwslFTBd47GLRMTbvG5+00FtLI7Lo38pfZUfH:/slDd474mfvG1uYcsZS

Score
10/10
slavecybergate

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

slave

C2

pumpin.zapto.org:100

Mutex

8L2JH8P1TY2RS6

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./ theme/wp-content/uploads/2011/

  • ftp_interval

    5

  • ftp_password

    bosess12

  • ftp_port

    21

  • ftp_server

    ftp.italian-diecast.com

  • ftp_username

    [email protected]

  • injected_process

    explorer.exe

  • install_dir

    WinDir

  • install_file

    Svchost.exe

  • install_flag

    true

  • keylogger_enable_ftp

    true

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    12345678

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

Files

  • 98f15e0efbc8200302d05d540d67f52c14d515f988db2b4f67796bab60213760
    .exe windows x86


    Headers

    Sections