Overview

overview

10

Static

static

10

1376-63-0x...ry.exe

windows7-x64

1

1376-63-0x...ry.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1376-63-0x0000000000400000-0x000000000044F000-memory.dmp

  • Size

    316KB

  • MD5

    a38a9651c2bbb8ca4f004b40a2bc93c9

  • SHA1

    15b3a157e5d91b1b69f20591cf2b930afde62b20

  • SHA256

    56ea7f238b7bde6d52157f62cfb2578ab5c9cc8da9c9ab253ce8829719e3baba

  • SHA512

    7afff45b44b3bde759ce8f7994f85117c98ba1a3a7f486b4a2745df074cf5c61fb1eeb41133d2c5899673144e4b8a91400ee76d41e0073e8ef531513f71143a3

  • SSDEEP

    6144:eOpslFlqdhdBCkWYxuukP1pjSKSNVkq/MVJb:ewsluTBd47GLRMTb

Score
10/10
habbocybergate

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

Habbo

C2

teemy.no-ip.org:86

Mutex

M465GNJ57KOD7N

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    false

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    123456

Signatures

  • Cybergate family
    cybergate
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 1376-63-0x0000000000400000-0x000000000044F000-memory.dmp
    .exe windows x86


    Headers

    Sections