Overview

overview

10

Static

static

10

8804a343a4...18.exe

windows7-x64

8

8804a343a4...18.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    8804a343a46c5aae060a2cddb028a37e_JaffaCakes118

  • Size

    428KB

  • MD5

    8804a343a46c5aae060a2cddb028a37e

  • SHA1

    69cd9cb049640244df174dc35d7e6796f38c8196

  • SHA256

    2f14029fe4aff1be3e648b931e7a6d5fe141d0d93d27d67599ba809ded22e574

  • SHA512

    94a402ec949646f0bee26f8fab520b4caa9a6b6fb62356bd6154bc6bdcf8dd5b06f6212d75312e10a972e3a8b3b37c7f7be7cae257afbb9dbd1c3b6b9981c8b5

  • SSDEEP

    6144:0OpslERlqgfmfmfqhdBCkWSzyEE81pjSKoW78U1bgibiDNX42uxcx8J5uybal9Co:0wsluuuqTBJeH87GAf11beNXwqxKMyb+

Score
10/10
remotecybergate

Malware Config

Extracted

Family

cybergate

Version

v1.07.0

Botnet

remote

C2

esam3at.no-ip.biz:246

Mutex

new

Attributes
  • enable_keylogger

    false

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    new

  • install_file

    new.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    1234567

Signatures

  • Cybergate family
    cybergate
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 8804a343a46c5aae060a2cddb028a37e_JaffaCakes118
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections