General
-
Target
a6a1f8bb2df3904b4c7691993c67c910_JaffaCakes118
-
Size
296KB
-
MD5
a6a1f8bb2df3904b4c7691993c67c910
-
SHA1
b25fec75fc82974295d37d0223a5277535ada64a
-
SHA256
3dcbbc520467c8e447e3d9fc1edb788178cd5efbe82ee2fc47c5666193127746
-
SHA512
b1178d10cad6c2917a9adeb218de64a20ef5eedfe4711f165f936a2477066c5c96d3be6b6da221326bf729d8902a91f55f00cc93e7a5e980a957068dc1b3d0b0
-
SSDEEP
6144:POpslFlqDhdBCkWYxuukP1pjSKSNVkq/MVJbC:PwsluTBd47GLRMTbC
Score
10/10
Malware Config
Extracted
Family
cybergate
Version
v1.07.5
Botnet
Cyber
C2
jacksonjonesjunior.zapto.org:780
Mutex
OMB4I1884AL8VP
Attributes
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
%System%
-
install_file
Svchost.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
lol999
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
Cybergate family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
a6a1f8bb2df3904b4c7691993c67c910_JaffaCakes118
Headers
Sections