Overview

overview

10

Static

static

10

496fa183e7...cf.exe

windows7-x64

10

496fa183e7...cf.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    496fa183e75e5d30d348ec95abc4a6374c078078ca1b544083dd3ee60f6aeecf

  • Size

    384KB

  • MD5

    265b3e82964cf94b75d72c470feb7f8f

  • SHA1

    3d3630335be986765261a2b5573b494a56ea9d93

  • SHA256

    496fa183e75e5d30d348ec95abc4a6374c078078ca1b544083dd3ee60f6aeecf

  • SHA512

    b056a739bac0a51297cdcf81bd5a6227f1b869613bb767549d249592c7a68a5bb68fddc3e45cbc3f6823905ac809c9fdea571f291f2fe1b76e78533afc3131f1

  • SSDEEP

    6144:i4ABF94WpAuO/50BTnqPd0Mpz7qhh4nXjjf8MZ9BKXKgBAdiBgPSsT1o6kGigmF:xUQGLE0kuGnESBGrBoP2oI

Score
10/10
remotecybergate

Malware Config

Extracted

Family

cybergate

Version

v1.04.8

Botnet

remote

C2

omega2.no-ip.biz:81

Mutex

S5M3S51BE7QG23

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    cybergate

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

Files

  • 496fa183e75e5d30d348ec95abc4a6374c078078ca1b544083dd3ee60f6aeecf
    .exe windows x86


    Headers

    Sections