General

  • Target

    6e805d6bef685ceb7b0e090fba63e0fa_JaffaCakes118

  • Size

    281KB

  • MD5

    6e805d6bef685ceb7b0e090fba63e0fa

  • SHA1

    be8608bf6987eb855d4c9f1f58d4e70ccb9f3fae

  • SHA256

    d352e9b680783e001f3de989d397e929a961a295f717cb068e46dfda3263c878

  • SHA512

    63587859aebe6950a14625ef95c0feb99984d03a61c00b78e68c57cd81c1ca8af4f19e66815f4a587d78b680dd5104d6528ae7550f16b29fa0fb54209b61e408

  • SSDEEP

    6144:uy+phZTwlTLfkixFUQKf3D7TnBAZ5qhbxz:r+pv0lYixsfvDBAzK9z

Score
10/10

Malware Config

Extracted

Family

cybergate

Version

v1.11.0 - Public Version

Botnet

Cyber

C2

Ojandmilk.no-ip.info:100

Mutex

YMR1I327A38Y1I

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs

  • ftp_interval

    30

  • injected_process

    svchost.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    123456

Signatures

  • Cybergate family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 6e805d6bef685ceb7b0e090fba63e0fa_JaffaCakes118
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections