General
-
Target
ac2bfd9fa1aac84c45e599bb7630f30e9d6c835ba569e77231f732edcc85ee87
-
Size
289KB
-
MD5
bab52342d7b205e7357744cb7d774911
-
SHA1
7fde15eeede0ba153adc83df7e2e1903410f9d8f
-
SHA256
ac2bfd9fa1aac84c45e599bb7630f30e9d6c835ba569e77231f732edcc85ee87
-
SHA512
adf1dc1ec5098bd9ad7f0c3dc44f558b5623f744a29c87004b7c0df1f108f2568e6e79753a07fbbabd21e365c9771a9c21424d1d01e9c12d95cd9b93b3b8ef73
-
SSDEEP
6144:GOpslFlq+hdBCkWYxuukP1pjSKSNVkq/MVJb6:GwsljTBd47GLRMTb6
Score
10/10
Malware Config
Extracted
Family
cybergate
Version
v1.07.5
Botnet
Drazz
C2
drazz-cbg.no-ip.biz:81
Mutex
Windll
Attributes
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
Win32
-
install_file
Windll.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
drazzlebg
-
regkey_hkcu
Win32
-
regkey_hklm
Win32
Signatures
-
Cybergate family
Files
-
ac2bfd9fa1aac84c45e599bb7630f30e9d6c835ba569e77231f732edcc85ee87
Headers
Sections