Overview

overview

10

Static

static

10

49cfb312dd...a2.exe

windows7-x64

10

49cfb312dd...a2.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    49cfb312ddb5f0e132ea5f4d843fe08a498967e7bcea285dd7d90b2ac706eba2

  • Size

    290KB

  • MD5

    38f99f9d8b910c49c224905e1dc5a687

  • SHA1

    88b87a6024bf2efb2c5c36c56f40d09027f7e4f3

  • SHA256

    49cfb312ddb5f0e132ea5f4d843fe08a498967e7bcea285dd7d90b2ac706eba2

  • SHA512

    3ba719630065251dbc3dc501e24620a37ca4aa4929f7d1f92c28dd0a2f173ccbca7e58e4e30634fbcb590d32875e1bc1563989c2efd61de9ed0c1d552811a9c1

  • SSDEEP

    6144:MmcD66RRjG5JGmrpQsK3FD2u270jupCJsCxC+:9cD663/92zkPaCxR

Score
10/10
arankarus.no-ip.orgcybergate

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

arankarus.no-ip.org

C2

arankarus.no-ip.org:1338

Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    win32.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    c4mp3r

  • regkey_hkcu

    win32

  • regkey_hklm

    win32

Signatures

Files

  • 49cfb312ddb5f0e132ea5f4d843fe08a498967e7bcea285dd7d90b2ac706eba2
    .exe windows x86


    Headers

    Sections