Overview

overview

10

Static

static

10

ca0f893e24...b7.exe

windows7-x64

ca0f893e24...b7.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

  • Target

    ca0f893e24bbef9a256f9eb62a36726277cc46ab040ab06900941556fff3f6b7

  • Size

    180KB

  • MD5

    b4beaba32227b4d7203e110db4b3e399

  • SHA1

    e5ce39ffbdaf64f2074fe1a69a09fa457eebc3ab

  • SHA256

    ca0f893e24bbef9a256f9eb62a36726277cc46ab040ab06900941556fff3f6b7

  • SHA512

    1a041634500acd905e8fd0c73da2bc9b99bd9bc094ec08bb7ee7704e0f6a316e7e713cf56d45efedc071a8fc473d4599cfaf5bd5bf5175fb92d70e945e094c9f

  • SSDEEP

    3072:IiGpsz8s8RqH+Hrs+OZZCAatgAyCVeWDaWYSQaa+7qA5hPS9xlfIqiT9cG:cRjC+LsxZZQttyCVxaWYSda4bHPS9x6b

Score
10/10
remotecybergate

Malware Config

Extracted

Family

cybergate

Version

v1.03.0

Botnet

remote

C2

127.0.0.1:7777

playboy.zapto.org:7777
Mutex

N00I75A85X3H3J

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    WindowsUpdate

  • install_file

    Svchost.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    cybergate

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

Files

  • ca0f893e24bbef9a256f9eb62a36726277cc46ab040ab06900941556fff3f6b7
    .exe windows x86


    Headers

    Sections