Overview

overview

10

Static

static

10

698ce40f75...18.exe

windows7-x64

10

698ce40f75...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    698ce40f75c2fb53370a239ec5ec6be0_JaffaCakes118

  • Size

    273KB

  • MD5

    698ce40f75c2fb53370a239ec5ec6be0

  • SHA1

    905e3f5ac902f3a77dd5ae1415efb8c6ff9a0a28

  • SHA256

    92ed69ed16f32f4944e05e7821b211892792e957459446f72ca4b78817a8869e

  • SHA512

    1d35259cda39abdfbdef3121d3bed4443a7a2a68490f973cc717b9a2b2bb792510b476b5adb5278a8d33e983219633ae80ee7d346aa9d59f752bf5f597562b4c

  • SSDEEP

    6144:f3LZ3sxZZQttyCVxaWYSdMU/77hlruc6XmDoTbcI7CPPdf:/peAtpVxagMU/plruchDofAPR

Score
10/10
desucybergate

Malware Config

Extracted

Family

cybergate

Version

v1.02.0

Botnet

desu

C2

netherpatch.no-ip.org:25565

Mutex

G16V45G0154FMC

Attributes
  • enable_keylogger

    true

  • enable_message_box

    true

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    winupdate

  • install_file

    winupdate.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    This is not a valid win32 application.

  • message_box_title

    Error!

  • password

    evn6k8ne

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • Cybergate family
    cybergate
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 698ce40f75c2fb53370a239ec5ec6be0_JaffaCakes118
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections