Overview

overview

10

Static

static

10

a0f7defbbd...18.exe

windows7-x64

10

a0f7defbbd...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    a0f7defbbddbe7463b0206d2541a2e5c_JaffaCakes118

  • Size

    289KB

  • MD5

    a0f7defbbddbe7463b0206d2541a2e5c

  • SHA1

    2991b63d2c7241de3eec76c723c8311e7ec60b50

  • SHA256

    32a977a80a272ca8fd29693c39cbce147940c6c3dcc549ec5087fa6e016a6be2

  • SHA512

    3142e8fb557e332f15c13b235923647e9f020e93014ade3a3dd721b7b338ce0b7376d9509a3d0ae4bf80342385502f48e06656c4c1ede2de4b8c262c4c54af01

  • SSDEEP

    6144:+OpslFlq6hdBCkWYxuukP1pjSKSNVkq/MVJbh:+wsldTBd47GLRMTbh

Score
10/10
epvpspread#1cybergate

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

epvpspread#1

C2

1337mak.dyndns-ip.com:3075

Mutex

GE887O400R5F52

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    drivers

  • install_file

    svchost.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    Er36@spercher

Signatures

  • Cybergate family
    cybergate
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • a0f7defbbddbe7463b0206d2541a2e5c_JaffaCakes118
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections