General
-
Target
0x003500000001564c-2.dat
-
Size
282KB
-
MD5
88f4c6b1a74cfab65a524eba5fb51890
-
SHA1
8ebecbe8f09d286da80db0397f2f01cf1ce00dc0
-
SHA256
9ac17e49e69dbdbe33525dfcecc73b7edbe64c3de554253146c77c80df64b9c6
-
SHA512
4fc6ec50f0f999b95cf7d9035ab1ba430fa610d89c073750097bc498c22ee681a18869e31f2c840019f030c507f3a170bcba276299be3339805f795417ff2dc2
-
SSDEEP
6144:FxJsGLnGZoxDNT/xQphU+jrlgzfuzt91C9NDyWId98HhqbxtHGZ9:XJsGaZ4h/xQp6+tqOYy9zo0S
Score
10/10
Malware Config
Extracted
Family
cybergate
Version
v1.02.1
Botnet
Lammer
C2
thzinhacker.ddns.net:1177
Mutex
Pluguin
Attributes
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./
-
ftp_interval
30
-
injected_process
svchost.exe
-
install_dir
Microsoft
-
install_file
Pluguin.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
VOCÊ FOI HACKEADO ...SEU SISTEMA SERÁ FORMATADO.
-
message_box_title
LAMMER
-
password
123
-
regkey_hkcu
Avirnt
-
regkey_hklm
Avgnt
Signatures
-
Cybergate family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
0x003500000001564c-2.dat
Headers
Sections