General
-
Target
5d158042a4e2cbc8423645fde390e8e7_JaffaCakes118
-
Size
281KB
-
MD5
5d158042a4e2cbc8423645fde390e8e7
-
SHA1
42cf212a2d301ec06d27311c3d070f81b2b25f5d
-
SHA256
ad3268b6bdf594e285c49e2e1a1ab02c062451cb2912a50d1e0280c51cf45df7
-
SHA512
1c8429a67c62333950ece6c7e8cc71a704f4c0ccc497c5716d0c76a0fa35f8e0d56609dd88fbc9f7c361119300d1d588ffed75baf3668797d357fd855f0f768f
-
SSDEEP
6144:4ScrLF4mp8D6WGc/YSlIipBReubLzeh7Yy0DMIdeXijk:Jciy78QSVnNyhsFMCeSjk
Score
10/10
Malware Config
Extracted
Family
cybergate
Version
v1.18.0 - Trial version
Botnet
Andrax03-16-12
C2
gp1990.no-ip.org:1990
Mutex
Q00W3PR166L34H
Attributes
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
Winzip
-
install_file
Windll.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
gp161990
-
regkey_hkcu
Windll
-
regkey_hklm
Windll
Signatures
-
Cybergate family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
5d158042a4e2cbc8423645fde390e8e7_JaffaCakes118
Headers
Sections