Overview

overview

10

Static

static

10

150b476717...18.exe

windows7-x64

10

150b476717...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    150b47671776ff6710521850c3e6dd51_JaffaCakes118

  • Size

    424KB

  • MD5

    150b47671776ff6710521850c3e6dd51

  • SHA1

    fb1e31ff664bd4ad09d9ae2fa77536b14a4bf6cf

  • SHA256

    f26d2e4396bc07c36fbbc52cda6342372b2faf007a09c57d075b809874bb2b38

  • SHA512

    c3341a43be3fab8731fdd395d46cb2ce248dbbe5841e453327586c56c46f06d3286d7316f86626812521ecfc6eb32c5e99c420da8ed070a7ba50e6464b85867d

  • SSDEEP

    6144:xOpslF0hdBCkWYxuukP1pjSKSNVkq/MVJbhvur6QE7P7:xwslmTBd47GLRMTbFuruP7

Score
10/10
remotecybergate

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

remote

C2

127.0.0.1:999

Mutex

V52VUNFW7HE4LQ

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • install_dir

    HHHHJ

  • install_file

    HJJJJJYer.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    cybergate

Signatures

  • Cybergate family
    cybergate
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 150b47671776ff6710521850c3e6dd51_JaffaCakes118
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections