General
-
Target
0dfd739759bfb65e94488f566a77484a_JaffaCakes118
-
Size
311KB
-
MD5
0dfd739759bfb65e94488f566a77484a
-
SHA1
2026aa523804096faf3743b951aaf12a3b4813f1
-
SHA256
4be30f23ae081fb4707f19b30bb5cebabc4aa4bad46d0c3975498223bef8565b
-
SHA512
6a396efab352589c6f42e236e6036a3f36b37d4eb63f4d62ef5599b100648559691de779e13ea28871b2debd38b1aa33b799211f815a230b226287fa267c3aab
-
SSDEEP
6144:mOpslFlq7s337hdBCkWYxuukP1pjSKSNVkq/MVJbR:mwsl8sH7TBd47GLRMTbR
Score
10/10
Malware Config
Extracted
Family
cybergate
Version
v1.07.5
Botnet
admin
C2
88.159.110.114:43594
192.168.0.104:43594
88.159.110.114:3307
192.168.0.104:3307
Mutex
8I4H8715CD208T
Attributes
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
Slide
-
install_file
Slideshow.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
admin
-
regkey_hkcu
fsd435
-
regkey_hklm
43543fsd
Signatures
-
Cybergate family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
0dfd739759bfb65e94488f566a77484a_JaffaCakes118
Headers
Sections