Overview

overview

10

Static

static

10

639545480a...18.exe

windows7-x64

10

639545480a...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    639545480ab0123ec866840c1965bed2_JaffaCakes118

  • Size

    290KB

  • MD5

    639545480ab0123ec866840c1965bed2

  • SHA1

    4ae919dfcf56b076d759f5ae8b25f68465f64037

  • SHA256

    0442fc4a96d9e1e866a727c91e6249736394592131da24613cee9f66c6bae56b

  • SHA512

    f2bcf46937f3f6cb18c1003bbef414a5d00daa2ae3d58fcc463d17777b20bac0dea0720eb2c9cc22637a001fe35342d2d79d77fa95b45ef41901baaf391ea141

  • SSDEEP

    6144:zmcD66RRje5JGmrpQsK3RD2u270jupCJsCxCn:KcD663HZ2zkPaCxy

Score
10/10
vítimacybergate

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

vítima

C2

kalmatrix.no-ip.org:1338

Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    true

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    lol

  • message_box_title

    Erro

  • password

    35513652

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • Cybergate family
    cybergate
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 639545480ab0123ec866840c1965bed2_JaffaCakes118
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections