Overview

overview

10

Static

static

10

76b7617575...18.exe

windows7-x64

10

76b7617575...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    76b7617575deb4eec5d2714ac58a5bbe_JaffaCakes118

  • Size

    717KB

  • MD5

    76b7617575deb4eec5d2714ac58a5bbe

  • SHA1

    7b4751e2e9dad79e6dc9f175711d4467c024fc0e

  • SHA256

    2e706f4ab61d3e65684c4fbfd1474c29c42e5c40bf3f4266c86d89611cd3195f

  • SHA512

    4b30e0e973f2a492220c2436eed74b6c6fb504be2274d36afea482cbb3ff5cc19acab65df34a476aabc0c321818078c9ac7aae4950228297707b2405e6aa7a40

  • SSDEEP

    6144:eOpslFlqNHFFfbphdBCkWYxuukP1pjSKSNVkq/MVJb:ewslepTBd47GLRMTb

Score
10/10
cybercryptercybergate

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

CyberCrypter

C2

thenewhost.np-ip.info:12345

Mutex

5GSL41IOJ572S8

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    WinHost.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • Cybergate family
    cybergate
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 76b7617575deb4eec5d2714ac58a5bbe_JaffaCakes118
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections