General
-
Target
fbc679e8696b36063806e89ac15a3dc42064b3f97a6036229e55cb8c1c3dd5ec
-
Size
275KB
-
MD5
e144a93b1704ca167ec369e5d5cfb0fb
-
SHA1
4486d8609a69282f038e55506f4ba4b2897f625e
-
SHA256
fbc679e8696b36063806e89ac15a3dc42064b3f97a6036229e55cb8c1c3dd5ec
-
SHA512
287e53a45545a0228bfba899ac31fad3bd77d44170b099ebe09851c1f375bc27d5606eca8c88df976fb90d77b4ead9417fc8a94c5ea1e3a15e387c9ea0321fe1
-
SSDEEP
6144:vxJsGLnH8oxDNT/xQphU+jrlgzfuzt91C9NDyWId98HhqbxtHGZU:5JsGr84h/xQp6+tqOYy9zo0V
Score
10/10
Malware Config
Extracted
Family
cybergate
Version
v1.02.1
Botnet
juninho2x2
C2
juninho2x2.zapto.org:15963
Mutex
TradeHackMuAway
Attributes
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
Microsoft
-
install_file
TradeHackMuAway.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
VOCÊ FOI HACKEADO ...SEU SISTEMA SERÁ FORMATADO.
-
message_box_title
LAMMER
-
password
123
-
regkey_hkcu
Avirnt
-
regkey_hklm
Avgnt
Signatures
-
Cybergate family
Files
-
fbc679e8696b36063806e89ac15a3dc42064b3f97a6036229e55cb8c1c3dd5ec
Headers
Sections