Overview

overview

10

Static

static

10

easyMalici...f5.exe

windows7-x64

10

easyMalici...f5.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    easyMalicious1f3cce001ef5.exe

  • Size

    289KB

  • MD5

    aeeaa8f12c66447488a03bc0118121cc

  • SHA1

    08ec8b8fb3c4a6c76c7e839ec0fe6908680b18f7

  • SHA256

    65f3cd2b7075e28c4a65f9687c5513be8020a47815c151143f8da59d89430aef

  • SHA512

    239eb587445eb6953f48695cb095010dfb67f48e00256d91893f011e8952863886e714bd542ddf609e4e953e99faa294eef5ab4b2763e949df7a335dc2ef7b63

  • SSDEEP

    6144:2OpslFlqbhdBCkWYxuukP1pjSKSNVkq/MVJbU:2wsl0TBd47GLRMTbU

Score
10/10
remotecybergate

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

remote

C2

oscarpenelo.synology.me:8000

Mutex

CMBXE3MIQ6D7V4

Attributes
  • enable_keylogger

    false

  • enable_message_box

    true

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    setup.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    555

Signatures

  • Cybergate family
    cybergate
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • easyMalicious1f3cce001ef5.exe
    .exe windows x86


    Headers

    Sections