General
-
Target
592-324-0x0000000000400000-0x0000000000455000-memory.dmp
-
Size
340KB
-
MD5
0066971651e7ab67ddbc24c3d567e7c5
-
SHA1
81ec084b1f91f938640fef588e08050dd9ab930b
-
SHA256
79347354f6cc481760cdecf6cbddf26ce09a48fee85157f0605ca3a80be8ae13
-
SHA512
1483205ce8ce046b3e89a0a24172ab2232ca3124e49e13c831b1d48ea95dc15da9b9a7a08ccc4f5c6c42339b0743f8161bbbd44ff169275250cf694290484d75
-
SSDEEP
6144:U+mcD66R45JGmrpQsK3RD2u270jupCJsCxCwI5qoD:ocD66HZ2zkPaCxu
Score
10/10
Malware Config
Extracted
Family
cybergate
Version
2.6
Botnet
Server
C2
abgx.duckdns.org:1212
abgx.duckdns.org:80
abgx.duckdns.org:1445
Mutex
***MUTEX***
Attributes
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
svchst
-
install_file
VIPHACK4.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
texto da mensagem
-
message_box_title
tÃtulo da mensagem
-
password
123
Signatures
-
Cybergate family
-
UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
592-324-0x0000000000400000-0x0000000000455000-memory.dmp
Headers
Sections