Overview

overview

10

Static

static

10

3c983720c5...18.exe

windows7-x64

3c983720c5...18.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

  • Target

    3c983720c5a4a68033e4d95918068812_JaffaCakes118

  • Size

    302KB

  • MD5

    3c983720c5a4a68033e4d95918068812

  • SHA1

    f53554220aaac5c2c968ddc409c78691f550496a

  • SHA256

    aca6dd539f8cb32a63f412af4e49e045316e21ffeaf90aa40a1a2e769e4ddcb4

  • SHA512

    ba60b24e6ef96346d0d7df37aac9f900f814a78c23226c1409ff8987c8b5dfae579c64f10020c8c9f4f2118bcab41b453f30934bbacd9cab6b9f77deea266158

  • SSDEEP

    6144:AmcD66R7E5JGmrpQsK3RD2u270jupCJsCxC1:pcD66rZ2zkPaCxu

Score
10/10
öííécybergate

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

ÖÍíÉ

C2

king711.no-ip.biz:82

Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    svchost.exe

  • install_file

    windows.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    t?tulo da mensagem

  • password

    abcd1234

Signatures

  • Cybergate family
    cybergate
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 3c983720c5a4a68033e4d95918068812_JaffaCakes118
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections