Overview

overview

10

Static

static

10

711629e856...18.exe

windows7-x64

10

711629e856...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    711629e856dd0d9ec533c3d12957431a_JaffaCakes118

  • Size

    284KB

  • MD5

    711629e856dd0d9ec533c3d12957431a

  • SHA1

    341026c0ed4b987cf8dd0a9b317b6d6bf53864eb

  • SHA256

    3fd27ae3e1952c1e4f84f6c0dcd34152f17946b318fc29f74fac0ae53618c075

  • SHA512

    ed549f8265b7ee6e2b7dca551ff28e7913f1d50932b21c000e220de0923fa3c7c9cecd1f231053dc68a09f2d700b014b94dcbdc0c6c91f99d0aae0eca342cca0

  • SSDEEP

    6144:4k4qm1FK4mSuJPggpbUs66yh7xMu4mMUAfdiDUE/HfI:D9OHuJPgaYxx0mMU6i/H

Score
10/10
upxöííécybergate

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

ÖÍíÉ

C2

f7loool.no-ip.info:288

Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    svchost.exe

  • install_file

    Win_Xp.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Please try again later.

  • message_box_title

    Error

  • password

    abcd1234

Signatures

  • Cybergate family
    cybergate
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • 711629e856dd0d9ec533c3d12957431a_JaffaCakes118
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections