Overview

overview

10

Static

static

10

87ba94d463...18.exe

windows7-x64

7

87ba94d463...18.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    87ba94d463f2abc767197a6a36da72c7_JaffaCakes118

  • Size

    283KB

  • MD5

    87ba94d463f2abc767197a6a36da72c7

  • SHA1

    103b3ffbce5f74abf081a898e18c086b375d12e8

  • SHA256

    f540be36351853c8d4a9aa5fc85d4dbbd35c36f3518fc18e0ec62905b97a06a9

  • SHA512

    67baddc792b02f32e400e87afe4d941ce7f7ca1f70eefcad16edcc0121e67adb98fe17b9e95b5257e35b7be4aa951f2a3ca3eb42636d814647a9773336d1177b

  • SSDEEP

    6144:jmcD66RRjZ5JGmrpQsK3RD2u270jupCJsCxCJ:acD663EZ2zkPaCxq

Score
10/10
merlincybergate

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

Merlin

C2

darkmerlin.no-ip.info:3461

Mutex

***MUTEX***

Attributes
  • enable_keylogger

    false

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    false

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

Signatures

  • Cybergate family
    cybergate
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 87ba94d463f2abc767197a6a36da72c7_JaffaCakes118
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections