Overview

overview

10

Static

static

10

5295b7f904...f2.exe

windows7-x64

10

5295b7f904...f2.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    5295b7f9047d6162ae3630f7404a603d8d719cbbf90ccb11ac906689fba02cf2

  • Size

    284KB

  • MD5

    5771b11e69d41f9cde93e8b8815476fa

  • SHA1

    7a99de0e9252d78ff96f28bd69980f68a76bdefc

  • SHA256

    5295b7f9047d6162ae3630f7404a603d8d719cbbf90ccb11ac906689fba02cf2

  • SHA512

    88b1764f17397382cded93611df3cc9b74a05936d78f44bc774eb532ffcfca0d675833c51bfb729da3de7d8695ebc5b0eeb36f8bbf37b4f95a454be2a0772134

  • SSDEEP

    6144:Zk4qmLCe5iSpn0vZcTp6sQaxKnKGApXzCBj/LJi:+9yhP0vuQaMD8Xz6F

Score
10/10
upxöííécybergate

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

ÖÍíÉ

C2

alsfa7-joordan.no-ip.biz:288

Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    svchost.exe

  • install_file

    windows.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • Cybergate family
    cybergate
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx

Files

  • 5295b7f9047d6162ae3630f7404a603d8d719cbbf90ccb11ac906689fba02cf2
    .exe windows x86


    Headers

    Sections

  • out.upx
    .exe windows x86


    Headers

    Sections