Overview

overview

10

Static

static

10

49e28584a5...b2.exe

windows7-x64

8

49e28584a5...b2.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    49e28584a5f6010690c7cf255aed27b2

  • Size

    301KB

  • MD5

    49e28584a5f6010690c7cf255aed27b2

  • SHA1

    c6cc62927c055b08c76e470df6cb25509aa30d60

  • SHA256

    0efff409a1f2aa1f2ccd1927fe5a5ea8edd0e7ea2a9491291e10d71420c7ef26

  • SHA512

    503236770609d41fbc6040c96fd6e7d7c2a7d45b3a0c5e7fd06f17f8d26d7caeeee041fd12bca5bd9fd5a5169a9db2312aa87651d6c9c820035b90f9d0ffb25b

  • SSDEEP

    6144:MmcD6tRRj15JGmrpQsK3RD2u270jupCJsCxC3:9cD6t3QZ2zkPaCxi

Score
10/10
vítimacybergate

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

vítima

C2

your_dns_here:81

promagic.zapto.org:81

magicpro.zapto.org:81

magic09.no-ip.org:82
Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    spynet

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • Cybergate family
    cybergate
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 49e28584a5f6010690c7cf255aed27b2
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections