Overview

overview

10

Static

static

10

282a64c878...2c.exe

windows7-x64

10

282a64c878...2c.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    282a64c878e0c438755f0de2c3df17251981b43e2bb008a87332bfce203d9d2c

  • Size

    1.0MB

  • MD5

    536e1e585a959103f372efcb4a5b06ea

  • SHA1

    0a6e6075a612c13a02418ee0834657566f3a8325

  • SHA256

    282a64c878e0c438755f0de2c3df17251981b43e2bb008a87332bfce203d9d2c

  • SHA512

    447bc58e298bab273c4092e20e4ff55fbd0ef8a2f26ba399a1595cd9f6bf38cbb26902bc6b9f3e1d0bfbc9f6b604731873279c78f2cbe60be36e742bd5130b21

  • SSDEEP

    24576:yQRziKrFnX189QhgujrnKXIsW+FOpTrgQpqVutfVt:NRziKrFuGhgujrnKXI+8pn/p/

Score
10/10
vítimacybergate

Malware Config

Extracted

Family

cybergate

Version

2.7 Beta 02

Botnet

vítima

C2

127.0.0.1:81

den4ik.sytes.net:81
Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    true

  • ftp_directory

    ./addons/

  • ftp_interval

    5

  • ftp_password

    KGKFP80

  • ftp_port

    21

  • ftp_server

    193.151.59.195

  • ftp_username

    cs28d195

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    true

  • message_box_caption

    Fixed by Z3RO 10.10.2011 FOR Zhyk.ru

  • message_box_title

    cSdEaTh FIXED v1.0

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

Files

  • 282a64c878e0c438755f0de2c3df17251981b43e2bb008a87332bfce203d9d2c
    .exe windows x86


    Headers

    Sections