Overview

overview

10

Static

static

10

c385aca5f6...be.exe

windows7-x64

3

c385aca5f6...be.exe

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    c385aca5f6c6d79e6851e7c2f09ea347b37a7123329d743b3c5e0dd92b9bbdbe

  • Size

    290KB

  • MD5

    f6145d3cd7628ad39eecd12272b10dee

  • SHA1

    8c4557a9ad6a8883bd7a6a7602e2a3d511c7eeff

  • SHA256

    c385aca5f6c6d79e6851e7c2f09ea347b37a7123329d743b3c5e0dd92b9bbdbe

  • SHA512

    315bbff66548cfb8b07a802b891ec2284d7f4f44e31723a7b6d2ca15b228cf3ea5d43be7e2e0f9bfe6eb28d754bc64e30849a7771105df0f75e812e42813299b

  • SSDEEP

    6144:7OpVGFlqQhdBCkWYxuukP1pjSKSNVkq/MVJbo:7wVGBTBd47GLRMTbo

Score
10/10
çóã öíícybergate

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

ÇÓã ÖÍí

C2

127.0.0.1:999

ayoubass.no-ip.biz:81
Mutex

Y7DNF212ODA376

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    voip phone V1.2.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    mod pass

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

Files

  • c385aca5f6c6d79e6851e7c2f09ea347b37a7123329d743b3c5e0dd92b9bbdbe
    .exe windows x86


    Headers

    Sections