Overview

overview

10

Static

static

10

9e3050ca2c...fa.exe

windows7-x64

10

9e3050ca2c...fa.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    9e3050ca2c48fbda27ef7cca55dd294f7140df05329fc01bd3689123e3f729fa

  • Size

    205KB

  • MD5

    80e72d3f65ed2e95ffe3cfd564e69e80

  • SHA1

    92d1487a44dfb40a65794c47b029c5735704196e

  • SHA256

    9e3050ca2c48fbda27ef7cca55dd294f7140df05329fc01bd3689123e3f729fa

  • SHA512

    cc1a70eb536c4833a7ca11b6a650ecfa7e82db9ba325d4990c3ccc96fd66a9b7d80cfe0a301c03ca81e34edc8f638e54d8bf6f87ec97fbae12e87af53507f142

  • SSDEEP

    3072:yltv6HSg+HfYGkraH17TAlDHu0HYcNLREFW3FhSN2YxTn2cx7GvW4DD87S/:yroj+BkraH17MlD177SEF8EIa/

Score
10/10
upxtrungcybergate

Malware Config

Extracted

Family

cybergate

Version

2.2

Botnet

trung

C2

giandiep.myvnc.com:81

127.0.0.1:81
Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    trung

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • Cybergate family
    cybergate
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx

Files

  • 9e3050ca2c48fbda27ef7cca55dd294f7140df05329fc01bd3689123e3f729fa
    .exe windows x86


    Headers

    Sections

  • out.upx
    .exe windows x86


    Headers

    Sections