General
-
Target
758977d23dc5742b0b19581215b7dd84_JaffaCakes118
-
Size
281KB
-
MD5
758977d23dc5742b0b19581215b7dd84
-
SHA1
710d9c14b76c269e21ea2b6c95a522ebc237ee5d
-
SHA256
e6b55fc6baa752fc6a6fa8b123afe298617705ee245f339822d4340b5c39bcbd
-
SHA512
e7983830b98876a223bab4be9312f1ffb75cf361e792c51659c4b4b34e50adfd4d4422c0017982b9fed16a24cad7df54c0420342128e7aacce77c76b731974e0
-
SSDEEP
6144:AScrLA4mp8D6WGc/YSlIipBReubLzeh7Yy0DMIdeXijf:Rcvy78QSVnNyhsFMCeSjf
Score
10/10
Malware Config
Extracted
Family
cybergate
Version
v1.18.0 - Crack Version
Botnet
remote
C2
127.0.0.1:81
Mutex
75S44G365UFW13
Attributes
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
install
-
install_file
server.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
cybergate
Signatures
-
Cybergate family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
758977d23dc5742b0b19581215b7dd84_JaffaCakes118
Headers
Sections