General
-
Target
98fb06313bcd3017c2faff9a6c63cbd77e2a97d25d35b63503ab4b83e830782b
-
Size
296KB
-
MD5
8cb997f4a406867f3078ec2a4ba8673b
-
SHA1
48518604187bd8a3c9ad68045c8daa3cbbb913a7
-
SHA256
98fb06313bcd3017c2faff9a6c63cbd77e2a97d25d35b63503ab4b83e830782b
-
SHA512
91edc2f3e3ff8fdea7d2a052bf237a33070bb2afb34b288b218787b464a47e6673b2c50a305e87fe6fd04c28c69d219376e118ce0b99a120d9dba0646760bbab
-
SSDEEP
6144:POpslFlqWhdBCkWYxuukP1pjSKSNVkq/MVJbD:PwsljTBd47GLRMTbD
Score
10/10
Malware Config
Extracted
Family
cybergate
Version
v1.07.5
Botnet
hacked
C2
127.0.0.1:123
Mutex
PURJ5L37R5D540
Attributes
-
enable_keylogger
true
-
enable_message_box
true
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
windr
-
install_file
svchsot.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
haha
-
message_box_title
haha
-
password
78963214
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
Cybergate family
Files
-
98fb06313bcd3017c2faff9a6c63cbd77e2a97d25d35b63503ab4b83e830782b
Headers
Sections