Overview

overview

10

Static

static

10

abb551d5cc...18.exe

windows7-x64

10

abb551d5cc...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    abb551d5cc790d989a16a1569d3bcaf7_JaffaCakes118

  • Size

    281KB

  • MD5

    abb551d5cc790d989a16a1569d3bcaf7

  • SHA1

    27ba9f890e18324310d4dba1e90203072689842f

  • SHA256

    308065f411b71d587de5367c8672c02fc7a2bf5e2adbdbe31d21f0c77871a02e

  • SHA512

    629189a7fb1023114cfd2db8f730fd930703db1a0314651e549099e16fdc807fddece00b106436a568dac0dcfc6def6445e9bd3e5419ae18f7c2a92323f03e14

  • SSDEEP

    6144:FS5p9WHFVvXKkWbmHCSkM0qdrsQCfhaCvsqG4v1p0HbCt2:Q38FFnWb42MuQk2wp0HOt2

Score
10/10
peoplecybergate

Malware Config

Extracted

Family

cybergate

Version

v1.20.11 - Trial

Botnet

People

C2

arthost.no-ip.org:139

91.224.228.138:139

10.3.174.28:139
Mutex

Y5NJ53T81PTSK3

Attributes
  • enable_keylogger

    false

  • enable_message_box

    false

  • ftp_directory

    ./logs

  • ftp_interval

    30

  • injected_process

    smss.exe

  • install_dir

    drivers

  • install_file

    csrsss.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    231174

  • regkey_hklm

    HKLM

Signatures

  • Cybergate family
    cybergate
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • abb551d5cc790d989a16a1569d3bcaf7_JaffaCakes118
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections