Overview

overview

10

Static

static

10

134c8bc631...0c.exe

windows7-x64

10

134c8bc631...0c.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    134c8bc631bf21119346e7b7dfefe91bf831d5be26d03dd054515e4ed2f0f20c

  • Size

    289KB

  • MD5

    86643b37f0b7c45c33f3415b47a1b3ed

  • SHA1

    06f2a0c8e3d39b5806c0560351fc0f54348de9db

  • SHA256

    134c8bc631bf21119346e7b7dfefe91bf831d5be26d03dd054515e4ed2f0f20c

  • SHA512

    15bb948f24112cd2de05b69b828e5654a91ce8c03a31f6ea416adb42c72953f98208b7e981f4e1b43c6b0c0aca6fc642c01f213d0f1edf3858ac58d06a24cfe4

  • SSDEEP

    6144:mOpslFlqWhdBCkWYxuukP1pjSKSNVkq/MVJbW:mwslxTBd47GLRMTbW

Score
10/10
hackedcybergate

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

hacked

C2

iprogrammer.no-ip.biz:100

Mutex

7QNV6QFA750V6M

Attributes
  • enable_keylogger

    true

  • enable_message_box

    true

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    Windir

  • install_file

    svchost.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Greyhacker's hack.9 will start.

  • message_box_title

    Greyhacker's hack.9

  • password

    123456

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

Files

  • 134c8bc631bf21119346e7b7dfefe91bf831d5be26d03dd054515e4ed2f0f20c
    .exe windows x86


    Headers

    Sections