Overview

overview

10

Static

static

10

b689f59f09...18.exe

windows7-x64

10

b689f59f09...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    b689f59f095fa12b1b1efd86e54a381d_JaffaCakes118

  • Size

    296KB

  • MD5

    b689f59f095fa12b1b1efd86e54a381d

  • SHA1

    af3afd97adbe82b037d8283bd91da78be61a2568

  • SHA256

    90004bf9830e0bf8e62f12c3823196a5071f5a0aae417b149366346da0d7c744

  • SHA512

    a427b639ecbc61a5f5e5627ea6ffe5eb039a2c613c3b706676e4f573f19a03e2bc728248c7069468454e9c91512badcb5243838529326bbaccc9691b5a29f9cb

  • SSDEEP

    6144:/OpslFlqVhdBCkWYxuukP1pjSKSNVkq/MVJbl:/wsleTBd47GLRMTbl

Score
10/10
remotecybergate

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

remote

C2

127.0.0.1:999

bd5.no-ip.biz:3175
Mutex

5566NBW8MSWU0E

Attributes
  • enable_keylogger

    true

  • enable_message_box

    true

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    rundl

  • install_file

    rundl.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    You Got Powned

  • message_box_title

    Remote

  • password

    6789sf

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • Cybergate family
    cybergate
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • b689f59f095fa12b1b1efd86e54a381d_JaffaCakes118
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections