Overview

overview

10

Static

static

10

88dcea8857...c3.exe

windows7-x64

10

88dcea8857...c3.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    88dcea88575481d5923f07f4f357c7fc82232fb4104bcf446495fbc6cc017fc3

  • Size

    1.2MB

  • MD5

    5e9471ce335c180941289dec5cda961b

  • SHA1

    90d7653d2d290347b8cc8f376b595206660e7a07

  • SHA256

    88dcea88575481d5923f07f4f357c7fc82232fb4104bcf446495fbc6cc017fc3

  • SHA512

    62d8d9baaa377e8b33ff908af1213d43be04d3413dbac5f849a9503d0f93c4dc092a72a5e1f40261301922240b2ca6b1c5de6831ec8024f2e3d2eac90b3f7c0d

  • SSDEEP

    24576:zvrgQpqVutfVPns/ebU1sle5TT3RMNyzsLtzSYtNQp6sfMa:f/pqMHLt2YtGJMa

Score
10/10
victimcybergate

Malware Config

Extracted

Family

cybergate

Version

2.7 Beta 02

Botnet

VicTiM

C2

192.168.0.146:81

Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • ftp_password

    ªš÷Öº+Þ

  • ftp_port

    21

  • ftp_server

    ftp.server.com

  • ftp_username

    ftp_user

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    true

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

Files

  • 88dcea88575481d5923f07f4f357c7fc82232fb4104bcf446495fbc6cc017fc3
    .exe windows x86

    35a9e9974c673669c35cafffdf20e1bf


    Headers

    Imports

    Sections