Overview

overview

10

Static

static

10

87c1d6b2d9...18.exe

windows7-x64

10

87c1d6b2d9...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    87c1d6b2d90686a045f2a58fa629441f_JaffaCakes118

  • Size

    290KB

  • MD5

    87c1d6b2d90686a045f2a58fa629441f

  • SHA1

    784ffb9481f1cf785c77ec7ec314f6fbc16dabdb

  • SHA256

    9b8282a70258c72368e3e6699e636fe171a341756aeacd0aa9c91af98fc4457d

  • SHA512

    aa65176439a7c493e3affee0581d3d433d0422aa264779f4b6344b763c43ace194642e8c7d0e40ebe24d603e861b19949affe19c324f7488a09de7587dfbfc5a

  • SSDEEP

    6144:4mcD66RRjH5JGmrpQsK3RD2u270jupCJsCxCx:RcD6632Z2zkPaCx6

Score
10/10
phumacybergate

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

phuma

C2

phumamuaway.no-ip.org:15963

Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    true

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    Windows Live Messenger.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Trade Hacker Ativado.

  • message_box_title

    Trade Hacker V1.0

  • password

    1234

  • regkey_hkcu

    Windows Live Messenger

  • regkey_hklm

    Windows Live Messenger

Signatures

  • Cybergate family
    cybergate
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 87c1d6b2d90686a045f2a58fa629441f_JaffaCakes118
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections