General

  • Target

    0x0008000000016117-12.dat

  • Size

    282KB

  • MD5

    9b0975e52c196e91d4bee83ec4a2d950

  • SHA1

    e049054e78b39dbc0d0b69ae88e03a86bab502a2

  • SHA256

    cd3ad6a8b2816ffcb6e38662071a3304562543e735fc730852316838c3ffefce

  • SHA512

    91d38e6b53dac21ad2dd1010e86957a76d890efe8e9cc4dee55d03055a73a86764bd17b183d8c604d0ab7eae792d0cd6d5e5d74e7037200f9267da20db643751

  • SSDEEP

    6144:VxJsGLnBwoxDNT/xQphU+jrlgzfuzt91C9NDyWId98HhqbxtHGZm:HJsGVw4h/xQp6+tqOYy9zo03

Score
10/10

Malware Config

Extracted

Family

cybergate

Version

v1.02.1

Botnet

Lammer

C2

appdiscordgg.duckdns.org:81

appdiscordgg.duckdns.org:80

Mutex

Pluguin

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./

  • ftp_interval

    30

  • injected_process

    svchost.exe

  • install_dir

    Microsoft

  • install_file

    svchost.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    VOCÊ FOI HACKEADO ...SEU SISTEMA SERÁ FORMATADO.

  • message_box_title

    LAMMER

  • password

    123

  • regkey_hkcu

    Microsoft

  • regkey_hklm

    Microsoft

Signatures

  • Cybergate family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 0x0008000000016117-12.dat
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections