Overview

overview

10

Static

static

10

1992-62-0x...ry.exe

windows7-x64

1

1992-62-0x...ry.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    1992-62-0x0000000000400000-0x000000000044F000-memory.dmp

  • Size

    316KB

  • MD5

    bdcc968067f247f95f03e8f9e5d65a0d

  • SHA1

    aa5de6ee8ab23076ebbb01cedb318a9860f58127

  • SHA256

    efd37324d1da4af96b1113c935117cb6830bfb14556b930d7d765c347a3244b3

  • SHA512

    867dad9f8798ad9daed9362e91a5ce11d71668150d3fe70423543374a8d0bd33cf5f98c437d5c94f324a9346eff3294ab16ecb1b8c002d815787b3580e6a6128

  • SSDEEP

    6144:WOpslERlqyhdBCkWSzyEE81pjSKoW78U1bgibiDNX4:WwslUTBJeH87GAf11beNX

Score
10/10
responsyscybergate

Malware Config

Extracted

Family

cybergate

Version

v1.07.0

Botnet

Responsys

C2

46.183.216.145:80

Mutex

1N8JB2121M551B

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    Sys64

  • install_file

    svchost.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    d0ntbreak1t

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • Cybergate family
    cybergate
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 1992-62-0x0000000000400000-0x000000000044F000-memory.dmp
    .exe windows x86


    Headers

    Sections