Overview

overview

10

Static

static

10

f24b04f985...18.exe

windows7-x64

10

f24b04f985...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f24b04f985268454727cbfb5cc2fb222_JaffaCakes118

  • Size

    296KB

  • MD5

    f24b04f985268454727cbfb5cc2fb222

  • SHA1

    18df6ba8453f7e111447c4240b7407fed1324378

  • SHA256

    39ef5ca17c37cec7d515e1f83beca5785b254df052e6fd23040cae8511b76b15

  • SHA512

    9a3c5d492141cca307b8e6ef752de1a1fb048eba6635b1d29e2366c6d75c6e5285077fb0a3fa44a8dac2b7a9ce4bc324edc1b69f762b7af72ba5fc4e3facceb0

  • SSDEEP

    6144:POpslFlqChdBCkWYxuukP1pjSKSNVkq/MVJbo:PwsltTBd47GLRMTbo

Score
10/10
cybercybergate

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

Cyber

C2

kuki1997.no-ip.biz:100

Mutex

3130TL856EF7P2

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    Windvr

  • install_file

    svchost.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    123456

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • Cybergate family
    cybergate
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • f24b04f985268454727cbfb5cc2fb222_JaffaCakes118
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections