Overview

overview

10

Static

static

10

9b851bab31...7e.exe

windows7-x64

10

9b851bab31...7e.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    9b851bab31da4498f47442b28e20237e

  • Size

    1.2MB

  • MD5

    9b851bab31da4498f47442b28e20237e

  • SHA1

    7deba212a3c82fc96b90ce3485a629f5ca9e49ab

  • SHA256

    9af86c3cd7b8636434aabed7801c11957d014e16a4ddfa1af7cc15992f0b1868

  • SHA512

    0b7edf9626cadb324b7e2942c31198932b25ec1d023627e61f0d9e59bfd22f84d427f14f86e034040a0e9335324e66a84109962c4d008803e37e3b27e1b9d3a8

  • SSDEEP

    24576:fo2U2nmmiU2nmmxYuILKs/PVLoHvFU2nmmxYuILKs/PVLoHvq5Prznj/27Z:Q25M5LrILhPpIvF5LrILhPpIvq5P/jsZ

Score
10/10
=pcybergate

Malware Config

Extracted

Family

cybergate

Version

2.7 J/M SE

Botnet

=P

C2

127.0.0.1:81

chibo7.no-ip.biz:80

chibo7.no-ip.biz:82

chibo7.no-ip.biz:288
Mutex

JoKeR/M@SK

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • Cybergate family
    cybergate
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 9b851bab31da4498f47442b28e20237e
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections