Overview

overview

10

Static

static

10

752b2957fc...fa.exe

windows7-x64

10

752b2957fc...fa.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    752b2957fcd05df706f5c2d3f9da3c3db5c357e7c331109f304cb41e40c2d4fa

  • Size

    621KB

  • MD5

    612aa165afc2d3a6492e7eecacb66072

  • SHA1

    7d6811e140de46dfbe77a45064a78d6832e4de14

  • SHA256

    752b2957fcd05df706f5c2d3f9da3c3db5c357e7c331109f304cb41e40c2d4fa

  • SHA512

    0c7db1554c5a82045cc885da05903f8bc3f9492c60cd4c5ad8929a0be5a50dbeaaf39b46bec3b2bb0119d25adfbb4882d892e9f056c99344c4b9e434b7d54da6

  • SSDEEP

    12288:dcD66NZ2zkPaCxk8/4YiNRXiTpCrhtuMU9FXX:dyZOklvGNQT8vuMU9J

Score
10/10
upxvítimacybergate

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

vítima

C2

vidaltower.no-ip.org:85

Mutex

***crazy***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    Win32

  • install_file

    system.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    jorgemanuel

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • Cybergate family
    cybergate
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx

Files

  • 752b2957fcd05df706f5c2d3f9da3c3db5c357e7c331109f304cb41e40c2d4fa
    .exe windows x86


    Headers

    Sections