Overview

overview

10

Static

static

10

7ed66f6b32...18.exe

windows7-x64

10

7ed66f6b32...18.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    7ed66f6b32a854d57a21a8d67733bd89c1abd4ca636a296d3458b98531236318

  • Size

    467KB

  • MD5

    0b8f7ba7a947db17a96cd0e89e3cdff0

  • SHA1

    52bfbf3ea69d1ea8bffac7d91a884a6ccd49059d

  • SHA256

    7ed66f6b32a854d57a21a8d67733bd89c1abd4ca636a296d3458b98531236318

  • SHA512

    57449ea089dd2ad4839f5bb017ce018b2d1419ecfeb10508ea4cf4893f525a20ee2e2be1ebe76ae718558bf474d244c71b5fbbf797278753d9b1ba91f9aad0b3

  • SSDEEP

    6144:iOpsl6V5hdBCkWYxuukP1pjSKSNVkq/MVJbsi6lwi8ebSDzOkNNWoTSGay:iwsliTBd47GLRMTbF6miRSBNNWoZZ

Score
10/10
darkvoidcybergate

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

darkvoid

C2

youowned.no-ip.biz:1520

Mutex

M526A878P7RP4U

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    WinDir

  • install_file

    Svchost.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    123456

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

Files

  • 7ed66f6b32a854d57a21a8d67733bd89c1abd4ca636a296d3458b98531236318
    .exe windows x86


    Headers

    Sections