Overview

overview

10

Static

static

10

02b9a72b6b...0a.exe

windows7-x64

10

02b9a72b6b...0a.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    02b9a72b6b957424ef83bd314fd7e1012bc074231f46d3623083068b38d3090a

  • Size

    951KB

  • MD5

    f5238abca4b55c49981db6517ae17202

  • SHA1

    27722f32cbb611b7226f063cde8063d19ba1c0cf

  • SHA256

    02b9a72b6b957424ef83bd314fd7e1012bc074231f46d3623083068b38d3090a

  • SHA512

    a6b344a40d16572d66a6e60414bd22e1d9f196a0ee954bd29e41bbb6f1fb7b5177ee2babd54fe25ee468b00390d2676c766b6cc7aa953829554fe9dc87c04ec5

  • SSDEEP

    24576:rysv8f6xi8T43iYSP6x4kkeczoHwLwWr4ltQyWVKRx/vO9LOxY:rD8fQiBiF6x4kHHwLwWr6lEAx3x

Score
10/10
upxremotecybergate

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

remote

C2

127.0.0.1:999

ssenato.ddns.net:100
Mutex

C4XEU1TV676V05

Attributes
  • enable_keylogger

    true

  • enable_message_box

    true

  • ftp_directory

    ./

  • ftp_interval

    30

  • ftp_password

    mg912665

  • ftp_port

    21

  • ftp_server

    www.me404.net

  • ftp_username

    menet

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    true

  • message_box_caption

    File maybe corrupted or incompleted

  • message_box_title

    CyberGate

  • password

    cybergate

Signatures

  • Cybergate family
    cybergate
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx

Files

  • 02b9a72b6b957424ef83bd314fd7e1012bc074231f46d3623083068b38d3090a
    .exe windows x86


    Headers

    Sections

  • out.upx
    .exe windows x86


    Headers

    Sections