Overview

overview

10

Static

static

10

bea6b417e6...09.exe

windows7-x64

10

bea6b417e6...09.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    bea6b417e6bda47a5311999ec64daa92c39e1a7d7d1956bd8bbd4380bc62f209

  • Size

    310KB

  • MD5

    c87d1c320edfaad489e6f280027283a1

  • SHA1

    5fa0bc74f74fc13b63c7939b3104a6c7004104d7

  • SHA256

    bea6b417e6bda47a5311999ec64daa92c39e1a7d7d1956bd8bbd4380bc62f209

  • SHA512

    25f8f51e4bcca73448171f8dd7e574422856cd6f902e3c0aef583a752d5e3e7fbe6e7fc18f69c1fd9be33c586821b32129d4159bc89da09418cc3db91eedd9e8

  • SSDEEP

    6144:1MFOiTQCS7i+iXTUJDAt9EG59q5ToQUNnx0meqFQF7WF/MdyCGPFe:1WjTQCSD5pkqxdUNnqmeAQ5WF/EyCGPI

Score
10/10
upxremotecybergate

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

remote

C2

pola.no-ip.biz:82

Mutex

DO53HE58F1O855

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    Conference Vox 1.2 By ~XT~.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    123456

Signatures

  • Cybergate family
    cybergate
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx

Files

  • bea6b417e6bda47a5311999ec64daa92c39e1a7d7d1956bd8bbd4380bc62f209
    .exe windows x86


    Headers

    Sections

  • out.upx
    .exe windows x86


    Headers

    Sections