Overview

overview

10

Static

static

10

4861651d52...18.exe

windows7-x64

10

4861651d52...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4861651d522cf96d1456e9c757a84d76_JaffaCakes118

  • Size

    283KB

  • MD5

    4861651d522cf96d1456e9c757a84d76

  • SHA1

    33a1ed78efbc9948613b08114e95d26bd31f7ff9

  • SHA256

    4cc848d89c4dca5f41f8c0175e7e57b2a58714c59172eb41e0cc681f6766d6e2

  • SHA512

    5f7e43fee5c1111d3f6f2ed82a02cd2f7f43ded4bc9668bb4f6cb326c50b46b6a5843626e34590d7588b33b78b3ded12e4875441b8a43f1dc4d30c3a2d3a0ca4

  • SSDEEP

    6144:+SURkqYrN9TIL9kvjAO8AR73St4PFmJcVqQ4nIvqKY:P8NYpdIL920iR73StKMJcVq7Bf

Score
10/10
pecryptcybergate

Malware Config

Extracted

Family

cybergate

Version

v1.15.4

Botnet

PEcrypt

C2

girl2woman.no-ip.biz:313

Mutex

M7AI02K4N21PCX

Attributes
  • enable_keylogger

    false

  • enable_message_box

    false

  • ftp_directory

    ./logs

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    system32

  • install_file

    scvhost.exe

  • install_flag

    false

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    whatelse30

Signatures

  • Cybergate family
    cybergate
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 4861651d522cf96d1456e9c757a84d76_JaffaCakes118
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections