Overview

overview

10

Static

static

10

3edb79c0e4...18.exe

windows7-x64

10

3edb79c0e4...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3edb79c0e40cdd96f06c9a15d0834c3e_JaffaCakes118

  • Size

    281KB

  • MD5

    3edb79c0e40cdd96f06c9a15d0834c3e

  • SHA1

    ecb3b1f7032f2009920b75c925ab21b6b3170ab0

  • SHA256

    af6f8eebcf46e60d76999fe32be639db503bd9f23f00dea6ba52363d9ca71118

  • SHA512

    f46fa44fd84dbc3a3649003e5286f43bdbee66e2a54c7635a455a483329cacf62b1632f88ff21e5481481aac5b28900be6937a961e4b6a470cd886f020e7394d

  • SSDEEP

    6144:HScrLF4mp8D6WGc/YSlIipBReubLzeh7Yy0DMIdeXijk:yciy78QSVnNyhsFMCeSjk

Score
10/10
andrax03-16-12cybergate

Malware Config

Extracted

Family

cybergate

Version

v1.18.0 - Trial version

Botnet

Andrax03-16-12

C2

gp1990.no-ip.org:1990

Mutex

Q00W3PR166L34H

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    Winzip

  • install_file

    Windll.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    gp161990

  • regkey_hkcu

    Windll

  • regkey_hklm

    Windll

Signatures

  • Cybergate family
    cybergate
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 3edb79c0e40cdd96f06c9a15d0834c3e_JaffaCakes118
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections