Overview

overview

10

Static

static

10

279ffb85de...92.exe

windows7-x64

8

279ffb85de...92.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    279ffb85de0a965c15ba6b841fbbafddecc33aaae7924150250243415595e892

  • Size

    277KB

  • MD5

    a875cff63189179038b5db20a9890b29

  • SHA1

    d5d8fd74c08f4ad814dfa530ba4b5090ffdf6fbb

  • SHA256

    279ffb85de0a965c15ba6b841fbbafddecc33aaae7924150250243415595e892

  • SHA512

    0e4d9aa41823f93cdbfdde879c8ae0ebac65e3e171a055b3827a22c7f7d13ba806dfc53a521f31c84a5221b1c5c32e5e44a6ae708fead4345f14e25e347ac1d8

  • SSDEEP

    6144:XyuMwiLdfY2m7mrUsqWBn837FNldObO3k1j4:iuMwr2m77sZB07FxObO32E

Score
10/10
testcybergate

Malware Config

Extracted

Family

cybergate

Version

v3.4.2.2

Botnet

TEST

C2

192.168.2.164:8080

Mutex

65UPW1HV84ER56

Attributes
  • enable_keylogger

    false

  • enable_message_box

    false

  • ftp_directory

    ./logs

  • ftp_interval

    30

  • injected_process

    ekrn.exe

  • install_dir

    Mozilla Firefox

  • install_file

    checkupdates.exe

  • install_flag

    false

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    tolga

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

Files

  • 279ffb85de0a965c15ba6b841fbbafddecc33aaae7924150250243415595e892
    .exe windows x86


    Headers

    Sections