General

  • Target

    13a2fda475e9d5d8444ca94239634c9f7bac0e3f82877d065fbe514b1a531134

  • Size

    294KB

  • MD5

    8d5117d0d9429bfbb146fb29a3c50650

  • SHA1

    a6d8fc54e82bf28133ef4741853cee80127b437a

  • SHA256

    13a2fda475e9d5d8444ca94239634c9f7bac0e3f82877d065fbe514b1a531134

  • SHA512

    2525cd6841a1ea1daaad5f4c6a515f766a6e6922e5258a22e0d405b8d620e13e8b05bea9ef6581442eb4718549a2f728c5c730a18d8af1af6c8c5623236eb73d

  • SSDEEP

    6144:GmcD66RRja5JGmrpQsK3RD2u270jupCJsCxCO:TcD663jZ2zkPaCxt

Score
10/10

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

ÖÍíÉ

C2

noiphacker2.zapto.org:288

Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    true

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    svchost.exe

  • install_file

    windows.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    A fatal exception 00 has occurred at XX This program has performed an illegal operationand will be shut down. If the problem persists, contact the program vendor

  • message_box_title

    Erorr

  • password

    abcd1234

Signatures

Files

  • 13a2fda475e9d5d8444ca94239634c9f7bac0e3f82877d065fbe514b1a531134
    .exe windows x86


    Headers

    Sections