Overview

overview

10

Static

static

10

845a11ffe7...18.exe

windows7-x64

10

845a11ffe7...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    845a11ffe706dfcc5a20e1012980f455_JaffaCakes118

  • Size

    290KB

  • MD5

    845a11ffe706dfcc5a20e1012980f455

  • SHA1

    94293043aeee415da02fd32c83a305ae1d7caa54

  • SHA256

    16003f0f60b572c8775bf6c3373e5e17460b0b5eb96ba410cd992e39bdc7b68b

  • SHA512

    2b9a7b6324647f66fe1bb552263719bb9478d851e3d29b3c8104829ae88422122a223fe011764ea9b19a671bca569066bd38ed85268eac3a6e7985a011527a27

  • SSDEEP

    6144:WOpslFlqthdBCkWYxuukP1pjSKSNVkq/MVJbv:WwslgTBd47GLRMTbv

Score
10/10
cybercybergate

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

cyber

C2

haystack1001.no-ip.org:1604

Mutex

0U432G03AM3V7N

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    WinDir

  • install_file

    Svchost.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    102083

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • Cybergate family
    cybergate
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 845a11ffe706dfcc5a20e1012980f455_JaffaCakes118
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections