General
-
Target
3f201ac6f1ec3da491abe0bf2cd48224_JaffaCakes118
-
Size
281KB
-
MD5
3f201ac6f1ec3da491abe0bf2cd48224
-
SHA1
fb4e4304b35571ce530e1cd1b33170d44f601bde
-
SHA256
90356c8b8041581686af4213194669e8c1ee5bf0d9cfd8c05724cb9e25be8f6f
-
SHA512
c2d31f8110288f007389211c708c05773e65d288f7a63d49c5da287d0ea306b06e303f34b31d155ec725c97483d6839b04bf2deecc7d82109b743a8a523e9d1f
-
SSDEEP
6144:Oy+phKTwlTLfkixFUQKf3D7TnBAZ5qhbxv:L+pc0lYixsfvDBAzK9v
Score
10/10
Malware Config
Extracted
Family
cybergate
Version
v1.11.0 - Public Version
Botnet
remote
C2
hackcpu.no-ip.biz:1337
Mutex
J6TH13MHW1Y8V3
Attributes
-
enable_keylogger
true
-
enable_message_box
true
-
ftp_directory
./logs
-
ftp_interval
30
-
injected_process
svchost.exe
-
install_dir
Google
-
install_file
GoogleTBUUPDate.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
You are not a VIP member visit the site register and order vip for all your favorite hacks today!!
-
message_box_title
GameKiller Vip Status
-
password
no-ip
-
regkey_hkcu
Share
-
regkey_hklm
Rapid
Signatures
-
Cybergate family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
3f201ac6f1ec3da491abe0bf2cd48224_JaffaCakes118
Headers
Sections