General
-
Target
6feba02aac94c9f0db5d07c59eeb2858ec6eab322ae98c436cc6cfa4ad177061
-
Size
274KB
-
MD5
9046c2384d9fd9f0b307b90dd5ef555e
-
SHA1
74b6e4cc202e45463377664d0e39271fe38c484f
-
SHA256
6feba02aac94c9f0db5d07c59eeb2858ec6eab322ae98c436cc6cfa4ad177061
-
SHA512
29e7215698659f0483f1fdf2ea6e5f4c2bd3d6404797c6abdcaa3077fed94e21a423937cd66ad729dfc278a9cf044fc5d7b14ee0fa5bbca9889d3ad5fc0cf5db
-
SSDEEP
6144:EMt238/m02m/90ovH9QoYyjMhFOm5dC5S8wEJfk:E738/m02po/ioLYXdC5DwEF
Score
10/10
Malware Config
Extracted
Family
cybergate
Version
v1.07.0
Botnet
andreas
C2
andreas1222.zapto.org:8989
Mutex
HARU8862RS5U07
Attributes
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
winlogon.exe
-
install_dir
install
-
install_file
server.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
prosexe pou pas prosexe ti kaneis eimai pantou se parakolouthw!
-
message_box_title
ERROR!
-
password
malakas
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
Cybergate family
-
UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
Files
-
6feba02aac94c9f0db5d07c59eeb2858ec6eab322ae98c436cc6cfa4ad177061
Headers
Sections
-
out.upx
Headers
Sections