Overview

overview

10

Static

static

10

36a9720b11...18.exe

windows7-x64

7

36a9720b11...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    36a9720b1188cf5c39608d9fe4521bb4_JaffaCakes118

  • Size

    290KB

  • MD5

    36a9720b1188cf5c39608d9fe4521bb4

  • SHA1

    70469d3694bef5abea4928682b02c8a5cf178a08

  • SHA256

    4d465f7529276a4600bc3db6c45f6eec3f5779c8e96383cc96decc99681d94d2

  • SHA512

    dde20781d22f5c792f1fb8f6ddf8dfb850aacb04c0c8f5111d1273c33fbb2458e10c70e076ea1a1be0294ed4d70833242fb3deb3228b7cc7e4e4e5e004ff7b85

  • SSDEEP

    6144:ImcD66RRj05JGmrpQsK3RD2u270jupCJsCxCa:BcD663hZ2zkPaCxV

Score
10/10
öííécybergate

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

ÖÍíÉ

C2

109.169.17.194:81

Mutex

***MUTEX***

Attributes
  • enable_keylogger

    false

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    svchost.exe

  • install_file

    windows.exe

  • install_flag

    false

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

Signatures

  • Cybergate family
    cybergate
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 36a9720b1188cf5c39608d9fe4521bb4_JaffaCakes118
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections