Overview

overview

10

Static

static

10

680b04c1e1...18.exe

windows7-x64

10

680b04c1e1...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    680b04c1e12ce75f6717a07df205172a_JaffaCakes118

  • Size

    290KB

  • MD5

    680b04c1e12ce75f6717a07df205172a

  • SHA1

    07d9e04d5388c4b717ade8e3ba4ff72a05054637

  • SHA256

    20efe1e23ba9cbe257b4cce658b396b553d75f2a44be3e24aef92e264555fa0e

  • SHA512

    c69697f8ee7e742df22c976223e2d279930c82254bd897eb099d676689551daa397fa2ce6abec940b4dd56781db7c39b46ca395891f11795fd4ba0135a72afb1

  • SSDEEP

    6144:4mcD66RRj95JGmrpQsK3RD2u270jupCJsCxCd:RcD663oZ2zkPaCxO

Score
10/10
öííécybergate

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

ÖÍíÉ

C2

vipvip3631.no-ip.biz:82

vipvip3631.no-ip.info:82
Mutex

vip

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • install_dir

    Outlook Express

  • install_file

    wabmig.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    vip

Signatures

  • Cybergate family
    cybergate
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 680b04c1e12ce75f6717a07df205172a_JaffaCakes118
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections