Overview

overview

10

Static

static

10

spr.exe

windows7-x64

10

spr.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    spr.exe
  • Size 276KB
  • Sample240119-2dnevsfcd9
  • SHA256 374e1cfd4204ff7833ca74d99952f6db74568966be4456c9c44342c8ee3dc53b
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
upx[email protected]cybergate

Malware Config

Extracted

Family

  • cybergate

Version

  • 2.6

C2

  • purzel.zapto.org:12345

Mutex

  • ***MUTEX***

Attributes
  • enable_keylogger

    false

  • enable_message_box

    true

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    svhost.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    nein spass aber dann kannste mal sehen wie schnell es geht ... beim nächsten mal bisschen schlauer sein und nicht an so ein scheiss glauben wie hack das gibts nicht ist alles fake oder sonstiges .......

  • message_box_title

    jetzt bist du gehackt ...

  • password

    nadine2

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • Cybergate family
    cybergate
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

File Explorer

  • spr.exe
    .exe 276KB
  • out.upx
    .exe 290KB

spr.exe

  • SHA256 374e1cfd4204ff7833ca74d99952f6db74568966be4456c9c44342c8ee3dc53b
  • MD5 SHA1 SHA512 SSDEEP
windows:4windowsx86arch:x86

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Unsigned PE

    Checks for missing Authenticode signature.

Minor OS version
0
Major OS version
4
Entry point
351360
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI
PDB paths