Overview

overview

10

Static

static

10

4d5e71e967...da.exe

windows7-x64

10

4d5e71e967...da.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4d5e71e967c16d841cb2e3c68e4c40a18a7a26df2f19803534ca6b6c975a03da

  • Size

    284KB

  • MD5

    08b4ce123be88feb7981d49d0d765081

  • SHA1

    cefbc2619aa359ff9e73d526cf8e4f384a3ab600

  • SHA256

    4d5e71e967c16d841cb2e3c68e4c40a18a7a26df2f19803534ca6b6c975a03da

  • SHA512

    51349e4e4526c0b8e7dd66f93cdb167e705f81471ce099d3c3752995532d3b6bacfe2551b4f448898860863af13dfa92ad53f7100b3b38be3afcb91bb02d154d

  • SSDEEP

    6144:bmcD66RRjW5JGmrpQsK3FD2u270jupCJsCxCU:CcD663v92zkPaCxn

Score
10/10
point blankcybergate

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

Point Blank

C2

ambotv18.no-ip.org:81

ambotv18.no-ip.org:82

ambotv18.no-ip.org:80

ambotv18.no-ip.org:4000
Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    Microsoft

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    123

  • regkey_hkcu

    System

  • regkey_hklm

    System32

Signatures

Files

  • 4d5e71e967c16d841cb2e3c68e4c40a18a7a26df2f19803534ca6b6c975a03da
    .exe windows x86


    Headers

    Sections