Overview

overview

10

Static

static

10

bb243d12ab...18.exe

windows7-x64

10

bb243d12ab...18.exe

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    bb243d12abfe94acd379d3d525f9ea6f_JaffaCakes118

  • Size

    289KB

  • MD5

    bb243d12abfe94acd379d3d525f9ea6f

  • SHA1

    5f8bc37680a33a3d535b36f5b3900e8300e14c5d

  • SHA256

    7d4fddb2dbdad85a7bc0868d8c4090510bc9ed478acf38c96ba2ea6a1ae84463

  • SHA512

    864bb5d32ac69e559bd1d001653fe05199c92e63b7497ee52092a6dd15ba1026e391c23d384174dcb7bcbe753c6425ce105d515b0fc67cca65ab16f86bd14128

  • SSDEEP

    6144:RUm73XlqWhdBCkWYxuukP1pjSKSNVkq/MVJbd:RZ737TBd47GLRMTbd

Score
10/10
remotecybergate

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

remote

C2

gto.no-ip.info:5050

Mutex

514H1T687HLJIY

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    win.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    cybergate

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • Cybergate family
    cybergate
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • bb243d12abfe94acd379d3d525f9ea6f_JaffaCakes118
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections