Behavioral task
behavioral1
Sample
40fc7c2aafe74a99c4293167ab7e851bf979ac2168e6acca194a2efbb5d61994.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
40fc7c2aafe74a99c4293167ab7e851bf979ac2168e6acca194a2efbb5d61994.exe
Resource
win10v2004-20220812-en
General
-
Target
40fc7c2aafe74a99c4293167ab7e851bf979ac2168e6acca194a2efbb5d61994
-
Size
70KB
-
MD5
83529dad6634add8fb3c5ae5a2bc9bd0
-
SHA1
6b234c347c16b1429472dfe5a1477e03148f6f75
-
SHA256
40fc7c2aafe74a99c4293167ab7e851bf979ac2168e6acca194a2efbb5d61994
-
SHA512
9e11cd1e1576fab8aa4906ca170d3003941786a93674cfb4db602db306a20e91d2493a30833ddd01031f76ff694b6efa424cffb7c05b7b4351604073c8fa2374
-
SSDEEP
1536:d3CdGlce3i8g/g0AJnVHHn3tCnkgVQrc+:RiGl1it/5AJnVnn3t4PVk
Malware Config
Extracted
cybergate
v1.05.1
client
127.0.0.1:999
4RU7SKV1AU78H6
-
enable_keylogger
false
-
enable_message_box
true
-
ftp_directory
./htdocs/
-
ftp_interval
30
-
ftp_password
197346825
-
ftp_port
21
-
ftp_server
ftp.0fees.net
-
ftp_username
fees0_13119641
-
injected_process
explorer.exe
-
install_dir
install
-
install_file
server.exe
-
install_flag
true
-
keylogger_enable_ftp
true
-
message_box_caption
This is not a valid System32 file 0x84769426. For solutions contact the software provider or go to www.hackfbin1min.com.
-
message_box_title
Error 537:
-
password
aman
Signatures
-
Cybergate family
Files
-
40fc7c2aafe74a99c4293167ab7e851bf979ac2168e6acca194a2efbb5d61994.exe windows x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 44KB - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 1024B - Virtual size: 544B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 8B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 230KB - Virtual size: 229KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ