Overview

overview

10

Static

static

10

4bf83c4fd9...aa.exe

windows7-x64

10

4bf83c4fd9...aa.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    4bf83c4fd9fc0dd1f07a85a7e90dc38bfb6b7f6538c287a2476de76c41aa01aa

  • Size

    282KB

  • MD5

    630cbf4927a248f5cd5bb8c934c7d480

  • SHA1

    26040b7779ba280456abc335c1d8e2367357edd6

  • SHA256

    4bf83c4fd9fc0dd1f07a85a7e90dc38bfb6b7f6538c287a2476de76c41aa01aa

  • SHA512

    90e07557f4339b71afbae344727d39426c9cee6a7a905286e868091d08b577b52bd9970783417851e071a3a842f6fb02b911afd7774b5228ab3ddc541c940da1

  • SSDEEP

    6144:lxJsGLnTooxDNT/xQphU+jrlgzfuzt91C9NDyWId98HhqbxtHGZJ:3JsGno4h/xQp6+tqOYy9zo0S

Score
10/10
lammercybergate

Malware Config

Extracted

Family

cybergate

Version

v1.02.1

Botnet

Lammer

C2

hackerdecontas.no-ip.org:80

hackerdecontas.no-ip.org:81

hackerdecontas.no-ip.org:82
Mutex

Pluguin

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    Microsoft

  • install_file

    Pluguin.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    O Hack Esta Atualizando Tenta Mais Tarde

  • message_box_title

    ERRO

  • password

    123

  • regkey_hkcu

    Avirnt

  • regkey_hklm

    Avgnt

Signatures

Files

  • 4bf83c4fd9fc0dd1f07a85a7e90dc38bfb6b7f6538c287a2476de76c41aa01aa
    .exe windows x86


    Headers

    Sections