Overview

overview

10

Static

static

10

930ae51e23...d6.exe

windows7-x64

930ae51e23...d6.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

  • Target

    930ae51e235ce06cccb1ea1abf939b9fd5e7eb157fcf97521af7c9e1e904d4d6

  • Size

    210KB

  • MD5

    92d9816c8357a2b2193c3d216332fef4

  • SHA1

    b9995f19a4dcfa67fd58e8bc1cef27ce3626c7a9

  • SHA256

    930ae51e235ce06cccb1ea1abf939b9fd5e7eb157fcf97521af7c9e1e904d4d6

  • SHA512

    b5127144a0c136de48d6e79edc58c9406cb8e0f12a46728d86af49bbd449b4b7c9fe0d9a99d288f4dba8549742d9a2c88ba0b2f9461d4225ce69b46966f9dc5e

  • SSDEEP

    3072:PATpuydVEOyqGnlqxIl4Z2BKhdOhbYCkW7E/Zuuke0EEQwpXTBROniNKYM:POpslFlqVhdBCkWYxuukP1pjSKG

Score
10/10
silentcybergate

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

SilenT

C2

wahedbhim.no-ip.org:100

Mutex

S04UMC28CB384I

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./public_html/

  • ftp_interval

    30

  • ftp_password

    wcw123

  • ftp_port

    21

  • ftp_server

    fbpss.net78.net

  • ftp_username

    a6991647

  • injected_process

    explorer.exe

  • install_dir

    WinDir

  • install_file

    Svchost.exe

  • install_flag

    true

  • keylogger_enable_ftp

    true

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    walid

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

Files

  • 930ae51e235ce06cccb1ea1abf939b9fd5e7eb157fcf97521af7c9e1e904d4d6
    .exe windows x86


    Headers

    Sections