Overview

overview

10

Static

static

10

f0d662ae3a...52.exe

windows7-x64

8

f0d662ae3a...52.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f0d662ae3a9c9e47959bc1e7866af18c747d92c5144661a52cd40b069fe2ca52

  • Size

    277KB

  • MD5

    c30a47f528b6f86823cec47488ad273b

  • SHA1

    1daf9f6f57bc4e7639e04df34ff9f618ad777c1b

  • SHA256

    f0d662ae3a9c9e47959bc1e7866af18c747d92c5144661a52cd40b069fe2ca52

  • SHA512

    1900db045513c0a0fb34a5b929862971b2cf718ecb072c530738b0784826dec1c4c8e61049e3624e4eeeca6a75ef38eafc076a70912cbfa73bcb806fca35d359

  • SSDEEP

    6144:XyuMwiLdfU2m7Bxv0Hn83Cz5VFNsdnL+xaLzqVbgazPc:iuMwZ2m7Bi0Cz5NsdLg0zybBzPc

Score
10/10
a1cybergate

Malware Config

Extracted

Family

cybergate

Version

v3.3.1.0

Botnet

a1

C2

qwe.no-ip.info:81

Mutex

540M7SO64LWG01

Attributes
  • enable_keylogger

    false

  • enable_message_box

    false

  • ftp_directory

    ./logs

  • ftp_interval

    30

  • injected_process

    svchost.exe

  • install_dir

    rd-RD

  • install_file

    fms.dll.exe

  • install_flag

    false

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    arm

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

Files

  • f0d662ae3a9c9e47959bc1e7866af18c747d92c5144661a52cd40b069fe2ca52
    .exe windows x86


    Headers

    Sections