Overview

overview

10

Static

static

10

b152bf43bd...13.exe

windows7-x64

10

b152bf43bd...13.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    b152bf43bdb3b41dbb525f68441d57ac8aa0d2d67e6a57b0304b1528af9fe213

  • Size

    281KB

  • MD5

    d502dec09fe0f789b8f8f3c4c239d985

  • SHA1

    96d82151c69f2eef0f57c26dc6313e5cc1f5c991

  • SHA256

    b152bf43bdb3b41dbb525f68441d57ac8aa0d2d67e6a57b0304b1528af9fe213

  • SHA512

    7f5286bd28399c6ff947c20235e4006d00f5945bd5e4ad4e07eec6b78e92b8a5a74fff01757f32381e671575a890824ce86420ae4e624e94523c9b089a6f4c68

  • SSDEEP

    6144:gScrL/4mp8D6WGc/YSlIipBReubLzeh7Yy0DMIdDXijX:xcIy78QSVnNyhsFMCDSjX

Score
10/10
remotecybergate

Malware Config

Extracted

Family

cybergate

Version

v1.18.0 - Crack Version

Botnet

remote

C2

merabti01.no-ip.info:288

Mutex

X7777T320210SE

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs

  • ftp_interval

    30

  • injected_process

    svchost.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    123

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

Files

  • b152bf43bdb3b41dbb525f68441d57ac8aa0d2d67e6a57b0304b1528af9fe213
    .exe windows x86


    Headers

    Sections