General
-
Target
f6681026b4ec31c7fb85d41a3285f46853b36ab0543737e7bf5b2ad8f2c5302a
-
Size
290KB
-
MD5
4e2f02af99a8cc0d8ba262ec3b4a74d9
-
SHA1
8367dafd621ba7c84a07b41e448226a7b33532e6
-
SHA256
f6681026b4ec31c7fb85d41a3285f46853b36ab0543737e7bf5b2ad8f2c5302a
-
SHA512
d7066a022e36fb52dc6bab1d790ff67b6ad4a4a201b1aa863cdd3f6a43c9271ecb5555ab48993d68aca9d9a6e81cd882996671b9d8357c1883ea48f6469adbd1
-
SSDEEP
6144:4mcD66RRjw5JGmrpQsK3RD2u270jupCJsCxCe:RcD663NZ2zkPaCx7
Score
10/10
Malware Config
Extracted
Family
cybergate
Version
2.6
Botnet
vítima
C2
sysinfo.no-ip.org:8000
Mutex
***MUTEX***
Attributes
-
enable_keylogger
true
-
enable_message_box
true
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
install
-
install_file
server.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Arquivo Corrompido!!! Clique em Ok para finalizar.
-
message_box_title
Mensagem
-
password
123456
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
Cybergate family
Files
-
f6681026b4ec31c7fb85d41a3285f46853b36ab0543737e7bf5b2ad8f2c5302a
Headers
Sections