Overview

overview

10

Static

static

10

c546b34db8...e6.exe

windows7-x64

10

c546b34db8...e6.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    c546b34db8bbb71a2ce184237bb218f291f6d5465478c7903a22aa45e95f27e6

  • Size

    289KB

  • MD5

    0bd379f56f6abe2572c6c478951b8cb2

  • SHA1

    fd681a221ee2716cb101f1b06b6d14678c6b6606

  • SHA256

    c546b34db8bbb71a2ce184237bb218f291f6d5465478c7903a22aa45e95f27e6

  • SHA512

    4bf6ca742ba4ab1b93aa2d49d4db7c3990171ecab514952a1bba177ded248b71bbb6bd464ae8fe812136ad3044b479fb60cc1b1d21a32e32ef277afa59e50097

  • SSDEEP

    6144:+OpslFlqUhdBCkWYxuukP1pjSKSNVkq/MVJb9:+wslFTBd47GLRMTb9

Score
10/10
torrentspreadcybergate

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

torrentspread

C2

awesomedancer.no-ip.biz:1432

Mutex

8X6UDRDYW61W4J

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    Microsoft

  • install_file

    winmedia.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    2341

  • regkey_hkcu

    HKCU

Signatures

Files

  • c546b34db8bbb71a2ce184237bb218f291f6d5465478c7903a22aa45e95f27e6
    .exe windows x86


    Headers

    Sections