Overview

overview

10

Static

static

10

3724be0114...f9.exe

windows7-x64

10

3724be0114...f9.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    3724be0114b94aaf3594d249cd5ed9f9.exe

  • Size

    282KB

  • MD5

    3724be0114b94aaf3594d249cd5ed9f9

  • SHA1

    d138c22c41079290617fae11688a636384fff17f

  • SHA256

    37f5e9fc2582a92fde7f337b2fcec1c1941ded954ef3e5f7e8f3abe3ba674bf1

  • SHA512

    7bc631f9e4144b2a58ec64c3a024c673e6eb8bc632faa9e400ffb5ee09b9629ddee265806c8b9958f2248a8ca6b16e56d6fb85c28d76d5009ea86b297587a8b2

  • SSDEEP

    6144:VxJsGLnMoxDNT/xQphU+jrlgzfuzt91C9NDyWId98HhqbxtHGZT:HJsGo4h/xQp6+tqOYy9zo0W

Score
10/10
msnmsgrftpcybergate

Malware Config

Extracted

Family

cybergate

Version

v1.01.12

Botnet

msnmsgrftp

C2

msnmsgrftp.no-ip.org:81

msnmsgrftp.no-ip.org:82

msnmsgrftp.no-ip.org:3460

msnmsgrftp.no-ip.org:4660
Mutex

msnmsgrftp

Attributes
  • enable_keylogger

    true

  • enable_message_box

    true

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    CG

  • install_file

    msnmsgrftp.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    El sistema se actualizo correctamente

  • message_box_title

    Aviso

  • password

    msnmsgrftp

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • Cybergate family
    cybergate
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 3724be0114b94aaf3594d249cd5ed9f9.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections