Overview

overview

10

Static

static

10

386f9d3ba4...49.exe

windows7-x64

10

386f9d3ba4...49.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    386f9d3ba4f6c5ae14587c69ae2f70c957bd4ea562e28246b632ee33c54bcd49

  • Size

    281KB

  • MD5

    c0fc2a4dac5e1bdbb7ce3edb78cac3e7

  • SHA1

    cfbd26d0c5729bf916baf465ec5ec6bd98718197

  • SHA256

    386f9d3ba4f6c5ae14587c69ae2f70c957bd4ea562e28246b632ee33c54bcd49

  • SHA512

    db52914fd66b9ae4a6e6675c2d801162dc186ab2a94be261f141d5e19df12303f83ab9df21d30df559d70ccbf1017500d3214a4285a002de544ac1eced94e49b

  • SSDEEP

    6144:+y+phjTwlTLfkixFUQKf3D7TnBAZ5qhbx5:7+pp0lYixsfvDBAzK95

Score
10/10
remotecybergate

Malware Config

Extracted

Family

cybergate

Version

v1.11.0 - Public Version

Botnet

remote

C2

yokki14.zapto.org:122

Mutex

OVGNP2UDPL0G05

Attributes
  • enable_keylogger

    true

  • enable_message_box

    true

  • ftp_directory

    ./logs

  • ftp_interval

    30

  • injected_process

    Svchost.exe

  • install_dir

    Google

  • install_file

    GoogleTBUupdate.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Data Nicht Öfnet

  • message_box_title

    sorry

  • password

    1111

  • regkey_hkcu

    ILOVELS

  • regkey_hklm

    BUNNIES

Signatures

Files

  • 386f9d3ba4f6c5ae14587c69ae2f70c957bd4ea562e28246b632ee33c54bcd49
    .exe windows x86


    Headers

    Sections