Overview

overview

10

Static

static

10

3132f1d58f...18.exe

windows7-x64

1

3132f1d58f...18.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    3132f1d58ffc692053fa306ca4ad9cdd_JaffaCakes118

  • Size

    301KB

  • MD5

    3132f1d58ffc692053fa306ca4ad9cdd

  • SHA1

    1672a9d1922dad8f92bc3d4c935d41d0d79634ed

  • SHA256

    90a84c0ddd608a577cf6eb6b2b9afaa8764dc63c3a67ef0dd896c082700222ba

  • SHA512

    a52bda9294ad4df3c393a827ae1e4327286494cc0d35955cbe703b767c37e7c8d92b522e2c39b0ad40cd1c45210dcfd2f3509c80b4cf5e5694b135f25b72a637

  • SSDEEP

    6144:rmcD66R7e5JGmrpQsK3RD2u270jupCJsCxC:ycD669Z2zkPaCx

Score
10/10
youyoucybergate

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

youyou

C2

hackerspr.no-ip.biz:288

Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    true

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    svchost.exe

  • install_file

    Win_Xp.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Please try again later.

  • message_box_title

    Error

  • password

    12345

Signatures

  • Cybergate family
    cybergate
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 3132f1d58ffc692053fa306ca4ad9cdd_JaffaCakes118
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections