General
-
Target
d0aa91a9d3e16e3e333e53ab74318dfa129c860644a9825e8fb8c0d834fbd7ab
-
Size
1.2MB
-
MD5
2f9c67ffa5b86f1cea501decf18a1245
-
SHA1
b009ba23d0a461379bcfd4a70cfbf35cf80afe2f
-
SHA256
d0aa91a9d3e16e3e333e53ab74318dfa129c860644a9825e8fb8c0d834fbd7ab
-
SHA512
46cb671bed12c5b0c9d8f1cbbb7e7858a762d6df4817e0d7eb0f1779cf4d12caf9ad2dd6fb18ac726da630ecea339b7ccc679cece265d588dc5c5a84c72599df
-
SSDEEP
6144:iOpslFlqt7N7SE7N7SrW+7N7SrWPhdBCkWYxuukP1pjSKSNVkq/MVJbZ:iwslSEGEdEmTBd47GLRMTbZ
Score
10/10
Malware Config
Extracted
Family
cybergate
Version
v1.07.5
Botnet
remote
C2
vrmzskr.zapto.org:1608
Mutex
EKE7G5K087R334
Attributes
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./lgs/
-
ftp_interval
10
-
ftp_password
0549204082
-
ftp_port
21
-
ftp_server
ftp.soulgamers.x10.mx
- ftp_username
-
injected_process
explorer.exe
-
install_dir
install
-
install_file
server.exe
-
install_flag
true
-
keylogger_enable_ftp
true
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
1558
-
regkey_hkcu
HKCU
Signatures
-
Cybergate family
Files
-
d0aa91a9d3e16e3e333e53ab74318dfa129c860644a9825e8fb8c0d834fbd7ab
Headers
Sections