General
-
Target
852ecc66330f482ab208aa0dbedee1d66fc1a7084527db469cdeca7ea6cc4fab
-
Size
200KB
-
MD5
cdf41d3b19bf8fb084e3fa21f6ef364b
-
SHA1
e4bdee90b38d8f9b81e635d29e18a21d92ee8766
-
SHA256
852ecc66330f482ab208aa0dbedee1d66fc1a7084527db469cdeca7ea6cc4fab
-
SHA512
b066a97dcd51d0174bb98a5546c417fa40b594fa1d52df031a4e5dc6b8281dcf566e60c43bb50ad4105879f73e83c21407f6f1a3aabb8903cdd01d6a8f6a8082
-
SSDEEP
6144:cRjC+LsxZZQttyCVxaWYSda4bHPS9x6qr6j0:Gj5eAtpVxag1bvgx6O
Score
10/10
Malware Config
Extracted
Family
cybergate
Version
v1.03.0
Botnet
remote
C2
127.0.0.1:7777
playboy.zapto.org:7777
Mutex
N00I75A85X3H3J
Attributes
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
WindowsUpdate
-
install_file
Svchost.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
cybergate
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
Cybergate family
Files
-
852ecc66330f482ab208aa0dbedee1d66fc1a7084527db469cdeca7ea6cc4fab
Headers
Sections