Overview

overview

10

Static

static

10

92ab7ac324...c7.exe

windows7-x64

10

92ab7ac324...c7.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    92ab7ac324f39d797e5d9f47dfd2d70718823f1c5e070e7ed0516f258c5631c7

  • Size

    433KB

  • MD5

    5301fb1e0565b4e4a4f01ad0de4509fb

  • SHA1

    13fd5db5694ef57ffc917ebc820200f1a0e40282

  • SHA256

    92ab7ac324f39d797e5d9f47dfd2d70718823f1c5e070e7ed0516f258c5631c7

  • SHA512

    49c30812fa0e856b5867cee12231fe41c87d9f5219c6513b093f06dbfdf922c8107db6712b5f2ff138e6f2d8fa1916a0ed45a4336064f90f13b101583555a5f5

  • SSDEEP

    6144:Ck4qmvaL0MdrGTolrMuepsMtB+XN9yxHFGqZKu1aDL8nwhhqblimbj0A1YAbur:99oPQK0m4MtBRGq+DvhhE30gQ

Score
10/10
upxvítimacybergate

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

vítima

C2

187.71.91.112:2000

Mutex

kkk

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    win32

  • install_file

    notepad.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • Cybergate family
    cybergate
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx

Files

  • 92ab7ac324f39d797e5d9f47dfd2d70718823f1c5e070e7ed0516f258c5631c7
    .exe windows x86


    Headers

    Sections

  • out.upx
    .exe windows x86


    Headers

    Sections