Overview

overview

10

Static

static

10

6c5cb75bc9...7f.exe

windows7-x64

8

6c5cb75bc9...7f.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    6c5cb75bc9badb0944c5d94892c2dc7f

  • Size

    281KB

  • MD5

    6c5cb75bc9badb0944c5d94892c2dc7f

  • SHA1

    58af847786cbf574aa9217c6fb641746c879b401

  • SHA256

    52b9179883ff9c6b36e3b52aa60bf48247098c95d056883f6651f32b946f910a

  • SHA512

    61b69d9c4dd9a3a57eaa2bcff3c9912ed5f4fac1c48773aa9e19c0a4be97625296cda69277b53969cfe1016d3c2efe12cb81b582d0d434a8f22d9a968d0b3360

  • SSDEEP

    6144:dS5p99HFVvXKkWbmHCSkM0qdrsQCfhaCvsqG4v1p0HbCtH:o3HFFnWb42MuQk2wp0HOtH

Score
10/10
cybercybergate

Malware Config

Extracted

Family

cybergate

Version

v1.20.11 - Trial

Botnet

cyber

C2

autonomousigwe.no-ip.biz:100

Mutex

U2TIRH8E6EY0C0

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    WinDir

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    qwerty

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • Cybergate family
    cybergate
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 6c5cb75bc9badb0944c5d94892c2dc7f
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections