Overview

overview

10

Static

static

10

f86d8d41a9...05.exe

windows7-x64

8

f86d8d41a9...05.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f86d8d41a9d9ed74eedfb175b763e8dbef598052bbf7cba1aef9a596d4fa9405

  • Size

    194KB

  • MD5

    92286040373b233a6f611973eada0b00

  • SHA1

    be3af3dbf8de5495662d47ae1f61060d817612ac

  • SHA256

    f86d8d41a9d9ed74eedfb175b763e8dbef598052bbf7cba1aef9a596d4fa9405

  • SHA512

    aeee2d9e86199276ebce66e62d67140b173756d6f501c2106cbf7702d8289877bb347ec4200925d4f07a8089cba811a8235f69c3942078db927adb3573f55497

  • SSDEEP

    3072:RiWmAlxYYXbeItPPjtq0svSa51sH4fUlknOF1d2sjca4vy:PxYYXbeICYa51ilkODd2sjh4vy

Score
10/10
r'séïïßö÷»úcybergate

Malware Config

Extracted

Family

cybergate

Version

2.1

Botnet

R'sÉÏÏßÖ÷»ú

C2

127.0.0.1:81

Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    ÕâÊÇÀ´×ÔÓÚRover12421µÄÎʺò£¡

  • message_box_title

    Rover12421µÄÎʺò

  • password

    abcd1234

Signatures

Files

  • f86d8d41a9d9ed74eedfb175b763e8dbef598052bbf7cba1aef9a596d4fa9405
    .exe windows x86


    Headers

    Sections