General
-
Target
ce21e27dd9b44c0230ca10edddf44c2d105a5986ae7b754bf7c42c67ec31eedb
-
Size
282KB
-
MD5
0f288058891fc8dc17260cf1105d02c0
-
SHA1
cc7220b147581352d00e150cf79422e0acf2fee1
-
SHA256
ce21e27dd9b44c0230ca10edddf44c2d105a5986ae7b754bf7c42c67ec31eedb
-
SHA512
9ed2c215cf7d64f2a45438ef76022017b3e00e2a3034323e212d8fafc1415b97bdd9a95d465ae0cae26144420f08940fdad3f54d74372d3673b77c4bb79098dd
-
SSDEEP
6144:5xJsG5nrAoxDNT/xQphU+jrlgzfuzt91C9NDyWId98HhqbxtHGZ9:LJsGdA4h/xQp6+tqOYy9zo0S
Score
10/10
Malware Config
Extracted
Family
cybergate
Version
v1.02.1
Botnet
CryptoSuite
C2
78.178.204.80:81
Mutex
67K0T0AX4QKR
Attributes
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
Microsoft
-
install_file
cftmons.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
www.CryptoSuite.com / YLN
-
message_box_title
CryptoSuite
-
password
tolga12345
-
regkey_hkcu
cftmons
-
regkey_hklm
cftmons
Signatures
-
Cybergate family
Files
-
ce21e27dd9b44c0230ca10edddf44c2d105a5986ae7b754bf7c42c67ec31eedb
Headers
Sections