General
-
Target
b6466f1319cde1cdcede204f5cb2fda0c6260afe2b2aa7988ed7316aab292503
-
Size
296KB
-
MD5
4acd88052f1ee7a65c6ec398dcaf62ad
-
SHA1
f820badb0386373f22c03a2e13f7243f280c5811
-
SHA256
b6466f1319cde1cdcede204f5cb2fda0c6260afe2b2aa7988ed7316aab292503
-
SHA512
db35c9ac0908abc96bf84a7af40911fd644f2f7778a448361c9420edc4f0d308c3fef659d323608ae402916895b73d5d0a0c11fa1d30a08bd4b2ef9cdada70ca
-
SSDEEP
6144:/OpslFlqEhdBCkWYxuukP1pjSKSNVkq/MVJbZ:/wslPTBd47GLRMTbZ
Score
10/10
Malware Config
Extracted
Family
cybergate
Version
v1.07.5
Botnet
nuevo
C2
bombilla.zapto.org:4662
denis77.zapto.org:4662
Mutex
UF6T3I3X720BEQ
Attributes
-
enable_keylogger
true
-
enable_message_box
true
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
windows
-
install_file
windows.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
net framework 4
-
message_box_title
services error
-
password
1234
-
regkey_hkcu
services
-
regkey_hklm
services
Signatures
-
Cybergate family
Files
-
b6466f1319cde1cdcede204f5cb2fda0c6260afe2b2aa7988ed7316aab292503
Headers
Sections