General

  • Target

    e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272

  • Size

    366KB

  • MD5

    1ced584972d8292b170f2381b2978fd4

  • SHA1

    7e13077c0df5ee3d9828d63094446513fdcedff6

  • SHA256

    e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272

  • SHA512

    604fc86bb8124e6a52e72bf8b04f1c8503db51336e7841f956c3e6fc4e3a45ecd6769d5393149ae37d97a8fb3ed4e68da15cecda896d0476338555e5232737e9

  • SSDEEP

    6144:rmcD66RRjAEncfEnc9CKFKbr5JGmrpQsK3RD2u270jupCJsCxCj:ycD663A7VDZ2zkPaCx8

Score
10/10

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

Server

C2

foryou0077.dyndns.biz:81

Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    spynet

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

Signatures

Files

  • e2358cdbb3cbee3d291a131fd4d8afa2d942ba2b2745ac47150279b2d00c9272
    .exe windows x86


    Headers

    Sections