Overview

overview

10

Static

static

10

99f4962e95...d4.exe

windows7-x64

10

99f4962e95...d4.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    99f4962e959f86fea910f7de6e4e1133a4d4702aaed55709c69a7c923bcbafd4

  • Size

    1.4MB

  • MD5

    96a727cc05c4bd7e8737d6d4f492309f

  • SHA1

    866dba7f50e0203ff3c3c4b7e5fb3189225a73fe

  • SHA256

    99f4962e959f86fea910f7de6e4e1133a4d4702aaed55709c69a7c923bcbafd4

  • SHA512

    c2b7df693f272e2b72bd5e3ddd00925f37348296e7690036a0e427b4b21a6c57ae77ead0c12fb433d8b8f473494e3a6691053e89e80e87f875b4bc0aa14e5605

  • SSDEEP

    24576:sQCj1q0eCj1q0XLtwCc26uGi2VCHXSBzTaDMsAQRL:bGq0eGq0XLWpYgBzsMsAQRL

Score
10/10
infectercybergate

Malware Config

Extracted

Family

cybergate

Version

2.7 Final

Botnet

Infecter

C2

jok3r-game.no-ip.org:81

Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    true

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    system32

  • install_file

    svchost.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    NTDLR manquant, is missing

  • message_box_title

    [IDM] Patch

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

Files

  • 99f4962e959f86fea910f7de6e4e1133a4d4702aaed55709c69a7c923bcbafd4
    .exe windows x86


    Headers

    Sections