General
-
Target
acc231161571577c600da926cbef7901_JaffaCakes118
-
Size
281KB
-
MD5
acc231161571577c600da926cbef7901
-
SHA1
ba76729f78e8c3ca2d0b0e8649a294d0f65cb334
-
SHA256
1e3a2536158895a6f93422cbf566e4dd6caedbcd24264540edb9717f4f46a6a7
-
SHA512
80249a54a191a5776f25381b86842b07f50548abb27fbd10505486fdfe2a09fd065b2cd7c3b7ccacfbf7d77dd5afbe85e0a7c81e6ed665c0a87414fb7af587f2
-
SSDEEP
6144:gScrLo4mp8D6WGc/YSlIipBReubLzeh7Yy0DMIdeXijB:xcny78QSVnNyhsFMCeSjB
Score
10/10
Malware Config
Extracted
Family
cybergate
Version
v1.18.0 - Crack Version
Botnet
sfaccimm
C2
francesco1.no-ip.org:81
Mutex
T1Q8651LSIL6DD
Attributes
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
install
-
install_file
server.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
123123
-
regkey_hkcu
Microsoft
-
regkey_hklm
Microsoft
Signatures
-
Cybergate family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
acc231161571577c600da926cbef7901_JaffaCakes118
Headers
Sections