Overview

overview

10

Static

static

10

8d4ec61bcf...1d.exe

windows7-x64

10

8d4ec61bcf...1d.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    8d4ec61bcfc8e3c592186364f50889230adee427b9724da60e7bd6727e1aa41d

  • Size

    282KB

  • MD5

    288a793587ec1e5b4a3e9350af60d790

  • SHA1

    d236edb9945b9ea4e7c0d6101f37ec349b113d39

  • SHA256

    8d4ec61bcfc8e3c592186364f50889230adee427b9724da60e7bd6727e1aa41d

  • SHA512

    8972c43be4798cdb1beac7358860eecca0c410f37854caa2f445658a7526bbbc9ec16cb0a9cc983a6f17173f5bfbe5daa0117e199ff027281cb4171ad4170927

  • SSDEEP

    6144:FxJsGLn/coxDNT/xQphU+jrlgzfuzt91C9NDyWId98HhqbxtHGZE:XJsG7c4h/xQp6+tqOYy9zo01

Score
10/10
lammercybergate

Malware Config

Extracted

Family

cybergate

Version

v1.02.1

Botnet

Lammer

C2

127.0.0.1:81

127.0.0.1:2000
Mutex

::::::::::Pluguin:::::::::::

Attributes
  • enable_keylogger

    true

  • enable_message_box

    true

  • ftp_directory

    ./

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    Microsoft

  • install_file

    Pluguin.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    VOCÊ FOI HACKEADO ...SEU SISTEMA SERÁ FORMATADO.

  • message_box_title

    LAMMER

  • password

    1111111

  • regkey_hkcu

    Avirnt

  • regkey_hklm

    Avgnt

Signatures

Files

  • 8d4ec61bcfc8e3c592186364f50889230adee427b9724da60e7bd6727e1aa41d
    .exe windows x86


    Headers

    Sections