Overview

overview

10

Static

static

10

b26c16d6f0...b7.exe

windows7-x64

b26c16d6f0...b7.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

  • Target

    b26c16d6f0e8e34253823e6c63b1e008c479f0004a467d4226049c4d8965ffb7

  • Size

    100KB

  • MD5

    0c8eb0f01edd9332bd8aceb2eed60551

  • SHA1

    46222777d04af5eb856cbfa9a4eb905393aba2f5

  • SHA256

    b26c16d6f0e8e34253823e6c63b1e008c479f0004a467d4226049c4d8965ffb7

  • SHA512

    d2889bf0486ce47034c2a7911b470621ac4f65eed2623cf27884b04eb436948f82dc307654dd7cabd64d2b466dd6276d831508aee238c219fe1f04ec0547430b

  • SSDEEP

    1536:xuoATp+AW5oUEVWqX6nk59QFAqj4ulqxIl4Zr+BcnxhCQOhjfYf:PATpuydVEOyqGnlqxIl4Z+BKhdOhbC

Score
10/10
matacybergate

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

mata

C2

alexsoftpro.zapto.org:1337

Mutex

66SE55216TKTI2

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    winupdate.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    LVUWAwNAAAAmflB4Jv1fiSk4m+3cT2ObyVSym1pO2fhprUIcc2D6pf7bO++

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

Files

  • b26c16d6f0e8e34253823e6c63b1e008c479f0004a467d4226049c4d8965ffb7
    .exe windows x86


    Headers

    Sections