Overview

overview

10

Static

static

10

9556f42472...8b.exe

windows7-x64

10

9556f42472...8b.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    9556f42472dfe7f9bdc3ea3a2d464dfd08558dd57f063910e22fa0de7a32a98b

  • Size

    281KB

  • MD5

    e858d097f502862da7752694d2fb324f

  • SHA1

    c79df42abbdf094bb1313e84157634666bd1c9dd

  • SHA256

    9556f42472dfe7f9bdc3ea3a2d464dfd08558dd57f063910e22fa0de7a32a98b

  • SHA512

    a551c97e2acdb0bcb503347fed7a879caa82d19095a3b4ed096c2b765351076ac9b546ea526ba6265244e3d390bc71e91dbc9073e1a6113b8d21e29c0c351681

  • SSDEEP

    6144:+y+phrTwlTLfkixFUQKf3D7TnBAZ5qhbxM:7+pl0lYixsfvDBAzK9M

Score
10/10
hd-modcybergate

Malware Config

Extracted

Family

cybergate

Version

v1.11.0 - Public Version

Botnet

HD-Mod

C2

stealtre.no-ip.biz:100

Mutex

58N3742PHYEAL6

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    1734.jpg

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    mesterhus

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

Files

  • 9556f42472dfe7f9bdc3ea3a2d464dfd08558dd57f063910e22fa0de7a32a98b
    .exe windows x86


    Headers

    Sections