General
-
Target
fbfb8b25c5485c026bed2ccde7af357a7eace19531e0eb5605a8d0ff9791fbca
-
Size
428KB
-
MD5
84393d37376c2d9a64c092cea2616b80
-
SHA1
f04cac0a5a2481ffa4ecca683f0e5f59efde4854
-
SHA256
fbfb8b25c5485c026bed2ccde7af357a7eace19531e0eb5605a8d0ff9791fbca
-
SHA512
1fc17878b2faf359e1b9cdf301818aa3809605d36b01666990af8e158c5306e7756bda4f61a7c3e3ffcce6ce48abddd1ae64add720f3928317ca3961895fccfd
-
SSDEEP
12288:huMwuBi8vvrHxVPKyv2m77sZB07FxObO32b:hHwX8vrx52t07FQao
Score
10/10
Malware Config
Extracted
Family
cybergate
Version
v3.4.2.2
Botnet
remote
C2
bygarip.no-ip.org:81
Mutex
5IPF6J3S55D31B
Attributes
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_file
plugins.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
cybergate
-
regkey_hkcu
thrhy
-
regkey_hklm
gt
Signatures
-
Cybergate family
Files
-
fbfb8b25c5485c026bed2ccde7af357a7eace19531e0eb5605a8d0ff9791fbca
Headers
Sections