Overview

overview

10

Static

static

10

542d3e1cd2...41.exe

windows7-x64

10

542d3e1cd2...41.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    542d3e1cd20de49d6c47c932d6b67441

  • Size

    570KB

  • MD5

    542d3e1cd20de49d6c47c932d6b67441

  • SHA1

    206587f1c1ab6ebf82b553b0f072bc0dcc9844d2

  • SHA256

    6fa269d6744667e59b27bcc64e17c689547eab0dc60b227b3002b511a2865c8c

  • SHA512

    abdc486ef92a1d8e3aa23730c8a30ae1e33f378b471b7cf4479bab9ae25b12228decf3755812b70f145bbcafdc7192bf17d9f52dbd796b4ee9353f0f5886695b

  • SSDEEP

    6144:zmcD66RRj//x73bXTa/x73bXTcTvxGz6bnIKoJ/x73bXTcTvxGz6bnIKoC5JGmrG:KcD663nei+9i+bZ2zkPaCxd

Score
10/10
testecybergate

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

teste

C2

hackerlucas.no-ip.org:81

Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    true

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    win322

  • install_file

    ddl.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    arquivo coroonpido

  • message_box_title

    erro

  • password

    lukas

  • regkey_hkcu

    win32

  • regkey_hklm

    win32

Signatures

  • Cybergate family
    cybergate
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 542d3e1cd20de49d6c47c932d6b67441
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections