Overview

overview

10

Static

static

10

f12fc68c69...18.exe

windows7-x64

10

f12fc68c69...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    f12fc68c69a042a04870bf356a6bcc3a_JaffaCakes118

  • Size

    291KB

  • MD5

    f12fc68c69a042a04870bf356a6bcc3a

  • SHA1

    de1c488c4ce576dc9ad3db876cad64a60a2f64ee

  • SHA256

    187372e87043efa3a06850b00c57b5d88c764727dfa78a99eceace77cc8358fb

  • SHA512

    7baadac31cd26b0caa7908fdb03c2a50b8c939cd45c7f4f37afdab2569a938ff66d69267104b96c7df163d215b86c2e1c37e265e5b07f35bfa7c182188f97f76

  • SSDEEP

    6144:RvnD66Lhj1cQEIXKgQjjXYj91EBToREujB5wZl5DLfVq4mExyP:xnD66h4eKgQnEb+D5LfV13yP

Score
10/10
vítimacybergate

Malware Config

Extracted

Family

cybergate

Version

2.7 Beta 02

Botnet

vítima

C2

mzagy-mncy.zapto.org:82

Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

Signatures

  • Cybergate family
    cybergate
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • f12fc68c69a042a04870bf356a6bcc3a_JaffaCakes118
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections