General
-
Target
6256e4ac1170a75bb1093d521dc4816f_JaffaCakes118
-
Size
281KB
-
MD5
6256e4ac1170a75bb1093d521dc4816f
-
SHA1
895e74b8f3ebf99c076fd246faa68bb1520bacd0
-
SHA256
106959adde54f6c9e3ec51cc5b963ee4c2b413eaeb9fea8fc27a9ed91b452bd7
-
SHA512
27db43619f0cdcfc9f2f4d81d8179c784e3d3d450e21c0030f49ded8e5dc4cfac5f85dba60d99331890bcaee39c34b45c8a3ebb3ab60e572f80717a21215b1b6
-
SSDEEP
3072:hqSaZpSYl97CmASqSaZpSYl97CmAkqSaZpSYl97CmAOXQqSaZpSYl97CmAOXolq:AScrLYScrLaScrLLpScrLL4sScrLL4
Score
10/10
Malware Config
Extracted
Family
cybergate
Version
v1.18.0 - Crack Version
Botnet
remote
C2
78.108.51.79:81
78.108.51.79:90
Mutex
M0U0X080QO4766
Attributes
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
Macromedia
-
install_file
sidebar.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
ladyinred
Signatures
-
Cybergate family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
6256e4ac1170a75bb1093d521dc4816f_JaffaCakes118
Headers
Sections