General
-
Target
5f8066f8d2ccc1b2cbf712595b72137d_JaffaCakes118
-
Size
281KB
-
MD5
5f8066f8d2ccc1b2cbf712595b72137d
-
SHA1
550ce89f3a621f0bb167a2ccd4f3dce161478ff0
-
SHA256
d085f60caf364e258cc964dce714c42c226f529d56a656c341fd808b780e39ee
-
SHA512
5cd3798aee82d4e123b4f5340b471cadc4f35e209533033881699a433dc88d3f3f4fed16b0d844720e6d4120572de89fbde489aedc99eda4fc6e7171400b994e
-
SSDEEP
6144:lScrLF4mp8D6WGc/YSlIipBReubLzeh7Yy0DMIdeXijk:wciy78QSVnNyhsFMCeSjk
Score
10/10
Malware Config
Extracted
Family
cybergate
Version
v1.18.0 - Trial version
Botnet
Andrax03-16-12
C2
gp1990.no-ip.org:1990
Mutex
Q00W3PR166L34H
Attributes
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
Winzip
-
install_file
Windll.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
gp161990
-
regkey_hkcu
Windll
-
regkey_hklm
Windll
Signatures
-
Cybergate family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
5f8066f8d2ccc1b2cbf712595b72137d_JaffaCakes118
Headers
Sections