Overview

overview

10

Static

static

10

1440-4-0x0...ry.exe

windows7-x64

1

1440-4-0x0...ry.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    1440-4-0x0000000000400000-0x000000000044B000-memory.dmp

  • Size

    300KB

  • MD5

    d61e5ca12c125d63fc11070a9eb4686b

  • SHA1

    5d12342dff6a4317feead3fede581957b40fda4b

  • SHA256

    9997dda895a0fe28244735abdea7d7102d42b1f6c9f192fc5ea6bb8dfedd7262

  • SHA512

    91b6062a12651feb970e3072dbdda7fe04bad4a2025fa987df773fa7f25397c8aae59c5abb677a597e0f6a21f65277057ec5cd135942ccb719dae696294df1aa

  • SSDEEP

    6144:T3O1ZeoxDNT/xQphU+MYerYctWC201Dxeb/b4N5MCLW/4DOY1ChWdI:TOq4h/xQp6+MYer3201tebT4n1LXP1Cl

Score
10/10
16cybergate

Malware Config

Extracted

Family

cybergate

Version

v1.01.18

Botnet

16

C2

mandanga.blogdns.com:4321

Mutex

PRUEBA

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    MSNlive

  • install_file

    msnlive.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    1qaz

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • Cybergate family
    cybergate
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 1440-4-0x0000000000400000-0x000000000044B000-memory.dmp
    .exe windows:4 windows x86


    Headers

    Sections