Overview

overview

10

Static

static

10

c1c82899e4...a8.exe

windows7-x64

10

c1c82899e4...a8.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    c1c82899e4ec9d353dd0b76ba4a319a2f5c41a7c559d9aac96eb625acbdbcba8

  • Size

    290KB

  • MD5

    6367cc2e00f37899ed8e1d493a49674b

  • SHA1

    821bd338a74f356ef007f722efbf141604258d7a

  • SHA256

    c1c82899e4ec9d353dd0b76ba4a319a2f5c41a7c559d9aac96eb625acbdbcba8

  • SHA512

    08bbb258c89f89d58437fb5a236ecde5ed550221997b8293a904347655fff70d8f1de1733013251d09e170472ff4831a9a748cd67394edb5b7252262ad431e4a

  • SSDEEP

    6144:wmcD66RRj85JGmrpQsK3RD2u270jupCJsCxCr:5cD663ZZ2zkPaCx2

Score
10/10
öííécybergate

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

ÖÍíÉ

C2

127.0.0.1:288

xvx.no-ip.org:288

xvx.no-ip.org:81

xvx.no-ip.org:147

xvx.no-ip.org:82

xvx.no-ip.org:122

xvx.no-ip.biz:288

xvx.no-ip.biz:81

xvx.no-ip.biz:147

xvx.no-ip.biz:82

xvx.no-ip.biz:122
Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    svchost.exe

  • install_file

    windows.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    t?tulo da mensagem

  • password

    abcd1234

Signatures

Files

  • c1c82899e4ec9d353dd0b76ba4a319a2f5c41a7c559d9aac96eb625acbdbcba8
    .exe windows x86


    Headers

    Sections