General
-
Target
db9f54d99d1a10fe736548e5f5692fb87f76bd40dcd41d7c7167bd3fbdd83532
-
Size
289KB
-
MD5
090380a0fe7faeb685b27f3f1c39f893
-
SHA1
b792fb89a83b895a534a492ce591c8430ba208d7
-
SHA256
db9f54d99d1a10fe736548e5f5692fb87f76bd40dcd41d7c7167bd3fbdd83532
-
SHA512
e26699b07a27a868073945b67a3d63f72388b64743b99340c1324ee375cc09ead87162279a68f239bf832b5c92e22d5995d16f91aaaf89eadb84779f5eb4be18
-
SSDEEP
6144:aHp4mcJlq1hdBCkWSzyEE81pjSKoW78U1bgibiDNX48:aJ4mfTBJeH87GAf11beNXj
Score
10/10
Malware Config
Extracted
Family
cybergate
Version
v1.07.0
Botnet
remote
C2
die.no-ip.org:999
Mutex
FA7K66N8VXMXLA
Attributes
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
install
-
install_file
service.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
Pa$$word
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
Cybergate family
Files
-
db9f54d99d1a10fe736548e5f5692fb87f76bd40dcd41d7c7167bd3fbdd83532
Headers
Sections