General
-
Target
e5b965d1745b2fb1921238d63e759be15add293bc347c414783634b25f4bc70b
-
Size
296KB
-
MD5
158c6761595ad11cbc2b3a3c5a6c92d0
-
SHA1
3325837c147777b88d356d6c7136a9c9f8459d08
-
SHA256
e5b965d1745b2fb1921238d63e759be15add293bc347c414783634b25f4bc70b
-
SHA512
70afe6c58a06e5ac4107971321f1240b0201b529b4e42079e8d4946c79df56b9c1d6a3159f8f5a38491c7e742c5dc16c6cc9d7e6316709ec4b5fbfdd9961a849
-
SSDEEP
6144:POpslFlq3hdBCkWYxuukP1pjSKSNVkq/MVJbb:Pwsl6TBd47GLRMTbb
Score
10/10
Malware Config
Extracted
Family
cybergate
Version
v1.07.5
Botnet
cyber
C2
meegablackieman.no-ip.biz:9999
Mutex
C3R503SW3W70YB
Attributes
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
install
-
install_file
server.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
wurschti
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
Cybergate family
Files
-
e5b965d1745b2fb1921238d63e759be15add293bc347c414783634b25f4bc70b
Headers
Sections