Overview

overview

10

Static

static

10

4cfa3d7327...8b.exe

windows7-x64

7

4cfa3d7327...8b.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    4cfa3d732722347579553f5073e5d68b

  • Size

    276KB

  • MD5

    4cfa3d732722347579553f5073e5d68b

  • SHA1

    94c7e0be3a3a74e33bbd0a54eb3f196adaf3fb72

  • SHA256

    8118b4e439c593d1c9509b726f116be2aec7e45ef745c0eb498c8469b35ffa30

  • SHA512

    d8239ba081288b8fd7857c84c41248131ead9ba3dd872b7d5721202d21b3bd88824f8af5ccbcf8afde839757f1bfdf3d5a30faf86ffaf68bf701c5a22f273c45

  • SSDEEP

    6144:bRjC++sxZZQttyCVxaWYSda4bHPS9x6qr6jDRPWHz6kp62kV/:1jUeAtpVxag1bvgx6NdC62kV/

Score
10/10
pigeoncybergate

Malware Config

Extracted

Family

cybergate

Version

v1.03.0

Botnet

pigeon

C2

evaltiere.no-ip.org:1604

Mutex

6MR4S2846V3488

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    .//

  • ftp_interval

    5

  • ftp_password

    croca

  • ftp_port

    21

  • ftp_server

    ftp14.redby.fr

  • ftp_username

    support

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    false

  • keylogger_enable_ftp

    true

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    lesviolons2

Signatures

  • Cybergate family
    cybergate
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 4cfa3d732722347579553f5073e5d68b
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections