Overview

overview

10

Static

static

10

64f771135a...41.exe

windows7-x64

10

64f771135a...41.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    64f771135a62f429357683187c9d6441

  • Size

    281KB

  • MD5

    64f771135a62f429357683187c9d6441

  • SHA1

    3b81496d638056e7166257563a5a799933e5d1c3

  • SHA256

    bf9fb3a8e7c8ec7630d833d1bc15fa9268a91e968630e1214d5d0d3a7b8c58d4

  • SHA512

    d2174e2dc7c52f6f627fd05e03ccb582ae7c622735e7e0007381d0aaf98d26a1a0257858a4c7338d0e89863456aff81d415f8f695a9a4d57c52c16d4f5cb3102

  • SSDEEP

    6144:+y+phDTwlTLfkixFUQKf3D7TnBAZ5qhbx6:7+pl0lYixsfvDBAzK96

Score
10/10
remotecybergate

Malware Config

Extracted

Family

cybergate

Version

v1.11.0 - Public Version

Botnet

remote

C2

iwillkillyou.no-ip.biz:82

Mutex

L7580V37H43J4M

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    Svchost

  • install_file

    Svchost.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    cybergate

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • Cybergate family
    cybergate
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 64f771135a62f429357683187c9d6441
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections