General
-
Target
3a60a3b3f02018baa7a3553bf3f051d7
-
Size
281KB
-
MD5
3a60a3b3f02018baa7a3553bf3f051d7
-
SHA1
1ff0028a4d0d1c4897293fa7baa5e4f25987a6d1
-
SHA256
719fd0fc45fc6978a22fb2d55d7c4b8c23f8655f63b36d6dad1d35ed0b291377
-
SHA512
19803901806390102153f520afe961fada7526b23ae979fe248feb85d6cbb23ddc5edde766969a92183f595493d874e410c992b8809e23b0f20cf260c1658b7c
-
SSDEEP
6144:uy+phbTwlTLfkixFUQKf3D7TnBAZ5qhbx4:r+pp0lYixsfvDBAzK94
Score
10/10
Malware Config
Extracted
Family
cybergate
Version
v1.11.0 - Public Version
Botnet
rsh
C2
rshc.no-ip.org:82
Mutex
V75716C4W3D511
Attributes
-
enable_keylogger
true
-
enable_message_box
true
-
ftp_directory
./logs
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
dwm
-
install_file
winmpsvr.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Microsoft .NET 2.5 Framework was not found. Please install then try again.
-
message_box_title
WinError 244x2
-
password
0123456789
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
Cybergate family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
3a60a3b3f02018baa7a3553bf3f051d7
Headers
Sections