General
-
Target
0dd5f56c70098c79855b2ea2bec46457_JaffaCakes118
-
Size
281KB
-
MD5
0dd5f56c70098c79855b2ea2bec46457
-
SHA1
137d0df464c24a64776edddd153f7f9c6b6ba57c
-
SHA256
92bc0ad2c6838aa1d48fa6baa85447c7595a0ee9b2f018eeb902fd8c58a3bd36
-
SHA512
bcb1d8733bc7ced32e96ea37190bfc115762f9243778db15efc8c09fbf1d6707fe766a85e4c6a270d316e8edd8d4ae098d9802f45c7067d7496eea312a75ae8f
-
SSDEEP
3072:hqSaZpSYl97CmAcqSaZpSYl97CmAoX+qSaZpSYl97CmAoXoXqSaZpSYl97CmAoXO:AScrL6ScrLlDScrLl4aScrLl4BScrL3
Score
10/10
Malware Config
Extracted
Family
cybergate
Version
v1.18.0 - Trial version
Botnet
remote
C2
78.108.51.79:81
78.108.51.79:90
Mutex
R0OT5B731624IH
Attributes
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
Macromedia
-
install_file
sidebar.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
ladyinred
Signatures
-
Cybergate family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
0dd5f56c70098c79855b2ea2bec46457_JaffaCakes118
Headers
Sections