General
-
Target
a50278ac641b25beff8d7f759f3e36a73bc0d8cd6196a3515d5c456e895b83c9
-
Size
276KB
-
MD5
6c68a7083c7b3c851d92554b8ac41180
-
SHA1
5b80abcaa0fa30b815307ad1cd655d5f0f2077aa
-
SHA256
a50278ac641b25beff8d7f759f3e36a73bc0d8cd6196a3515d5c456e895b83c9
-
SHA512
05c8f491c21d651581fbef8dded001c48f8d12cfdf370c13dc03dbb55023e05cc0a8f254007e998cb57f645f305f504a2896b1fafa22ea398efe6ecfb41e0f71
-
SSDEEP
6144:P4ABF94GpAuO/50BTnqPd0Mpz7qhh4nXjjf8MZ9BKXKL:AUKGLE0kuGnESBL
Score
10/10
Malware Config
Extracted
Family
cybergate
Version
v1.04.8
Botnet
remote
C2
1q.no-ip.biz:5150
Mutex
N321KF788N6507
Attributes
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
win
-
install_file
win.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
1qwasdzxcv
-
regkey_hkcu
HKCUik
-
regkey_hklm
HKLMkl
Signatures
-
Cybergate family
Files
-
a50278ac641b25beff8d7f759f3e36a73bc0d8cd6196a3515d5c456e895b83c9
Headers
Sections