Overview

overview

10

Static

static

10

230372e8e5...95.exe

windows7-x64

10

230372e8e5...95.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    230372e8e566acc99b1d1059e8810595

  • Size

    294KB

  • MD5

    230372e8e566acc99b1d1059e8810595

  • SHA1

    739e097f035227fc3edf912f68c8ebdc25e87fc5

  • SHA256

    6b666ea8e873bb760e6bdafc29dffd9e704a416307a8694ef01aee31ec81cf00

  • SHA512

    21cdd69c2cfdb796561d7c4f82f2b8f27e6c3d3fbdfef2d6de81bd53a65bfedd048f37b062c0abe8c8543f92c0abfdbd15e4c110297c8cc43f42360dfe9b7710

  • SSDEEP

    6144:amcD66RRjJ5JGmrpQsK3RD2u270jupCJsCxCg:vcD663UZ2zkPaCxp

Score
10/10
stupid-ass-holecybergate

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

stupid-ASS-hole

C2

imback.no-ip.org:44

Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    winlogon.exe

  • install_dir

    swset32

  • install_file

    winlogon.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    police

  • regkey_hkcu

    HKCU

Signatures

  • Cybergate family
    cybergate
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 230372e8e566acc99b1d1059e8810595
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections