General
-
Target
7c6edfe0ccebb2e3ddd7eb8ef8dfc360bf9de08f8b909c34adafea569c387e28
-
Size
281KB
-
MD5
141afeec6ec00f49ce1c05c192f6ae30
-
SHA1
43cbc2e6c264d113e2f8079ef02ea8d517e77055
-
SHA256
7c6edfe0ccebb2e3ddd7eb8ef8dfc360bf9de08f8b909c34adafea569c387e28
-
SHA512
c1b62a44566615e09b7789d580ab8359fc837324f5c3d08e04a520b879c0e75d84ae8255470e9ada9570c9270d550c2637d0c1f4d999d4b87872c50e17b351d4
-
SSDEEP
6144:gScrLw4mp8D6WGc/YSlIipBReubLzeh7Yy0DMIdeXijC:xcfy78QSVnNyhsFMCeSjC
Score
10/10
Malware Config
Extracted
Family
cybergate
Version
v1.18.0 - Crack Version
Botnet
remote
C2
belrus.no-ip.biz:5666
Mutex
DN3NN7FEHJET7Y
Attributes
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
System
-
install_file
systemWOT.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
lakosta
-
regkey_hkcu
systemWOT.exe
-
regkey_hklm
systemWOT.exe
Signatures
-
Cybergate family
Files
-
7c6edfe0ccebb2e3ddd7eb8ef8dfc360bf9de08f8b909c34adafea569c387e28
Headers
Sections