Overview

overview

10

Static

static

10

968575226d...a5.exe

windows7-x64

10

968575226d...a5.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    968575226d09ba5d3d0b02b3f68aeac03c7b132738bd8f86e7b308f7a19567a5.exe

  • Size

    190KB

  • MD5

    80f9ef26097224c6409e38536991747d

  • SHA1

    bf0d1fdfd80959400826809f0d5ea3c46364f136

  • SHA256

    1dd05aed784da310f469566e9d424bc7e8b08b9d54595286fde06fff9c28d7a7

  • SHA512

    0eb161dab87708265b6e994d8e27bb54c278e289b4966ea8b648bedcd11aebda549f690736eb56ab56722389b748ad2d43890e66a0c4ad8eebde32365fe5f862

  • SSDEEP

    3072:1iWmAlxYIxbeItPPjtq0svSa51sH4fUlknOF1d2sjca4v:zxYIxbeICYa51ilkODd2sjh4v

Score
10/10
r'séïïßö÷»úcybergate

Malware Config

Extracted

Family

cybergate

Version

2.1

Botnet

R'sÉÏÏßÖ÷»ú

C2

heihei.12sf.cn:84

heihei.12sf.cn:87

heihei.12sf.cn:91

heihei.12sf.cn:93

heihei.12sf.cn:97

heihei.12sf.cn:2010

heihei.12sf.cn:2006

heihei.12sf.cn:2023

heihei.12sf.cn:1997
Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./C:\ÁÄÌì¼Ç¼/

  • ftp_interval

    30

  • ftp_password

    QQqq88008

  • ftp_port

    21

  • ftp_server

    heihei.12sf.cn

  • ftp_username

    467005130

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    ggservice.exe

  • install_flag

    true

  • keylogger_enable_ftp

    true

  • message_box_caption

    ÕâÊÇÀ´×ÔÓÚRover12421µÄÎʺò£¡

  • message_box_title

    Rover12421µÄÎʺò

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • Cybergate family
    cybergate
  • Detects binaries and memory artifacts referencing sandbox product IDs 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 968575226d09ba5d3d0b02b3f68aeac03c7b132738bd8f86e7b308f7a19567a5.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections