Overview

overview

10

Static

static

10

8ab366f9d0...ef.exe

windows7-x64

10

8ab366f9d0...ef.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8ab366f9d043fbcc5116d9499f70b3d6212d8b4fe76703b7b682197d09686bef

  • Size

    576KB

  • MD5

    161d99b2df30da6c933656acae5b0528

  • SHA1

    e190e92746231e2d572405a0fe4522d6349d51d3

  • SHA256

    8ab366f9d043fbcc5116d9499f70b3d6212d8b4fe76703b7b682197d09686bef

  • SHA512

    0ba6f57a254dc80d8bec6c87df00fcdedcfa2ad93b70ff3c017f7b20f9da02bb8dd0537860735acb3d58859ab8ffe9736a707e53e62bc3ffcf6e27bcac41ee91

  • SSDEEP

    6144:YScrLEjUEFPA4mp8D6WGc/YSlIipBReubLzeh7Yy0DMIdeXijzjUEFPC:pcxE9y78QSVnNyhsFMCeSjcEA

Score
10/10
zgzagcybergate

Malware Config

Extracted

Family

cybergate

Version

v1.18.0 - Crack Version

Botnet

zgzag

C2

zgzag.no-ip.biz:2525

zgzag.no-ip.biz:6666

krkrme.no-ip.info:2525

krkrme.no-ip.info:6666

lolome.no-ip.org:2525

lolome.no-ip.org:6666
Mutex

1OWX5O042H0P41

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    dirme.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    1122010

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

Files

  • 8ab366f9d043fbcc5116d9499f70b3d6212d8b4fe76703b7b682197d09686bef
    .exe windows x86


    Headers

    Sections