General

  • Target

    cc2e4bec061d9519a748c70ee77d7545721f77251fdf37508852f473d773fafa

  • Size

    296KB

  • MD5

    a040dc3fe0178a2678c74ca3cbf7863c

  • SHA1

    30aac4a345d3455c1302852a54d59ea9c46e0f3d

  • SHA256

    cc2e4bec061d9519a748c70ee77d7545721f77251fdf37508852f473d773fafa

  • SHA512

    ccd8067fcf063beb915bcf655f955e9fb04cbdf013957147157ecf87be750e65a1fecbb1eecf23bbb2a3cb7f78ce92e888f192aed8a3e365bf3cfd4cddd42b91

  • SSDEEP

    6144:POpslFlqAhdBCkWYxuukP1pjSKSNVkq/MVJbm:PwslpTBd47GLRMTbm

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

C2

fun420.no-ip.info:1064

Mutex

T33UY5OS3WHD64

Attributes
  • enable_keylogger

    true

  • enable_message_box

    true

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    BURRRRRRP!!!!!

  • message_box_title

    HI

  • password

    matrisch18m

Signatures

Files

  • cc2e4bec061d9519a748c70ee77d7545721f77251fdf37508852f473d773fafa
    .exe windows x86


    Headers

    Sections