General
-
Target
6e93a7eae8cfc5ebd7fa990757037411ba0a8d8294a09162d49f0e59eb3853f7
-
Size
276KB
-
MD5
4c49b13e78be30704ceb69c781c3f3fa
-
SHA1
8000c6e592ba10a77cf91fc5870015f6c417e7dc
-
SHA256
6e93a7eae8cfc5ebd7fa990757037411ba0a8d8294a09162d49f0e59eb3853f7
-
SHA512
b901a87a97353f181af923a1d6f237a721c1cdec98190b5fc5fb03735584cf13114152cb24f24c365d10beecc4158c501fc7dd2045714e87a45a47ff4878b8c4
-
SSDEEP
6144:/4ABF94x3pAuO/50BTnyZsSaXhh4XAS79hO9R0O91FG+N:wUtGLyWSKaAS79MEqfG6
Score
10/10
Malware Config
Extracted
Family
cybergate
Version
v1.05.1
Botnet
remote
C2
3xch4ng3.no-ip.biz:90
Mutex
3ODETYQW7J5TYH
Attributes
-
enable_keylogger
true
-
enable_message_box
true
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
install
-
install_file
svchost.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Error Code : 1234 0xC0001234
-
message_box_title
Unable to open file.
-
password
cybergate
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
Cybergate family
Files
-
6e93a7eae8cfc5ebd7fa990757037411ba0a8d8294a09162d49f0e59eb3853f7
Headers
Sections