General
-
Target
d53cb5db8fd0838b1aa7c6f5d37887939d2680df01b4d6f391b124522dca1ad5
-
Size
428KB
-
MD5
c70b94fcb8e26c33b33b02e37f53ceea
-
SHA1
5705ab7dd38baf77013fbd3c6aef248d47e6a5ff
-
SHA256
d53cb5db8fd0838b1aa7c6f5d37887939d2680df01b4d6f391b124522dca1ad5
-
SHA512
6779f29e387db1332e712363fafac01cd9ac3e0eb46c523aeffdaceb998b4ca3bd49e733bffbbc463ce3fb05bf59b6ec0d97d07268396f266f3591f1e80869b1
-
SSDEEP
12288:RuMwiBi8vvrHxVPKyv2m77sZB07FxObO32A:RHw78vrx52t07FQa5
Score
10/10
Malware Config
Extracted
Family
cybergate
Version
v3.4.2.2
Botnet
remote
C2
mrghostnash.sytes.net:8386
Mutex
6ET7IE32JDG5R1
Attributes
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
Driver
-
install_file
Sonido.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
123
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
Cybergate family
Files
-
d53cb5db8fd0838b1aa7c6f5d37887939d2680df01b4d6f391b124522dca1ad5
Headers
Sections