Overview

overview

10

Static

static

10

b35582c0a2...18.exe

windows7-x64

10

b35582c0a2...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    b35582c0a264aa53a5075e8555b826d9_JaffaCakes118

  • Size

    338KB

  • MD5

    b35582c0a264aa53a5075e8555b826d9

  • SHA1

    7bfe627f3215205c36349a457f563654ddd78c63

  • SHA256

    5f7f496c42def7b7cbd6e196de3807a4c36ed6a02f0b24f3b842cea5a1d4bcf7

  • SHA512

    cc1589da6d78d0a22e1ccaec292edd1a9068b1dd846baeb17a2feb7598db7a2f4e46822df70701b6da08cbfbfdda88c3398e09794c3b3805c734e6527c30e7ac

  • SSDEEP

    6144:tmcD66Rz5JGmrpQsK3RD2u270jupCJsCxCvIc5d:4cD66wZ2zkPaCxm

Score
10/10
upxjodetecybergate

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

jodete

C2

eli333.no-ip.org:2000

Mutex

esoes

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    system32

  • install_file

    msn.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    messi

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • Cybergate family
    cybergate
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • b35582c0a264aa53a5075e8555b826d9_JaffaCakes118
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections