General

  • Target

    97e07cbb94de50d2f2d39d235f182fb1_JaffaCakes118

  • Size

    299KB

  • MD5

    97e07cbb94de50d2f2d39d235f182fb1

  • SHA1

    859061d33f0b02a0f495839e5478efbfc7bec5f9

  • SHA256

    bcfed66512188e47455f53cfb616c6ee76eed612cf81e97cb89415f0b99289a1

  • SHA512

    c72a10d96c928a4064e9514487c407edc3c18e2537105e3fb305452e9c663c8a8d0fb000503fd427fe5dc5e22823ae99582bd7f89bb5bd28f5576e9d97116709

  • SSDEEP

    6144:omcD66RRj/5JGmrpQsK3RD2u270jupCJsCxCb:hcD663+Z2zkPaCxW

Score
10/10

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

vítima

C2

trak.no-ip.org:2000

Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    123

  • regkey_hkcu

    Win32

  • regkey_hklm

    Win32

Signatures

  • Cybergate family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 97e07cbb94de50d2f2d39d235f182fb1_JaffaCakes118
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections