Overview

overview

10

Static

static

10

ba6c842c16...95.exe

windows7-x64

8

ba6c842c16...95.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    ba6c842c16edfe5a0464e094a1e15725453ba4fd3a1108170f7385b45b00b195

  • Size

    281KB

  • MD5

    15a357fa46e08d41414b576101bd3eb1

  • SHA1

    b5c4c680d9980c574c4d1f96fc5d1f18c549256a

  • SHA256

    ba6c842c16edfe5a0464e094a1e15725453ba4fd3a1108170f7385b45b00b195

  • SHA512

    b2d5ede7582a4912a80e51b1f4bec9846588ced7fe37a69866885b8fac1e154a9346fdf08ba86152cf733885723d5aa9e0ac9ec83a020132bd19e25208c2b862

  • SSDEEP

    6144:+y+phVTwlTIBgFUQ23QIKPhzD61+XEQY48A:7+pD0lIBgMAfN214lR

Score
10/10
800m?cybergate

Malware Config

Extracted

Family

cybergate

Version

v1.11.0

Botnet

800m?

C2

boykanyon.no-ip.biz:8777

boykanyon.no-ip.biz:4500
Mutex

0OO1IV0342PL8S

Attributes
  • enable_keylogger

    true

  • enable_message_box

    true

  • ftp_directory

    ./logs

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    update.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    cant run on windows operating system.

  • message_box_title

    Error

  • password

    cybergate

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

Files

  • ba6c842c16edfe5a0464e094a1e15725453ba4fd3a1108170f7385b45b00b195
    .exe windows x86


    Headers

    Sections