Overview

overview

10

Static

static

10

328fe4478d...8b.exe

windows7-x64

10

328fe4478d...8b.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    328fe4478d2bc01a80ee8d44b1fa20f34649ac51a74639c81650253bd650e88b

  • Size

    428KB

  • MD5

    498db6dce4cbb02ca79c64ae3bff04b0

  • SHA1

    22d9c7d7a7d9961d0d9e9182292f216512e57c8d

  • SHA256

    328fe4478d2bc01a80ee8d44b1fa20f34649ac51a74639c81650253bd650e88b

  • SHA512

    72482b557272285643523b1f6b2c8f3ec7be3d7f8d7da86672fdbcd7ba673dd5e9c81b305a1c223d5911850da71ed315228316fbc2186992c5975d041aa65121

  • SSDEEP

    12288:RuMwKBi8vvrHxVPKyv2m77sZB07FxObO32e:RHwD8vrx52t07FQan

Score
10/10
remotecybergate

Malware Config

Extracted

Family

cybergate

Version

v3.4.2.2

Botnet

remote

C2

79.114.223.141:81

Mutex

Q76C2R0HH0V703

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    cmd

  • install_file

    cmd.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    123

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

Files

  • 328fe4478d2bc01a80ee8d44b1fa20f34649ac51a74639c81650253bd650e88b
    .exe windows x86


    Headers

    Sections