Overview

overview

10

Static

static

10

bec020fb05...18.exe

windows7-x64

10

bec020fb05...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    bec020fb05305a8bed7c385c3341af04_JaffaCakes118

  • Size

    281KB

  • MD5

    bec020fb05305a8bed7c385c3341af04

  • SHA1

    d17e47ecb78b842f10abd8cfff58a03f806ce7fd

  • SHA256

    2e8ff74a6cd8f9d62ae253f55be1507d988a6ce6032c79e53d37b8de74e269e2

  • SHA512

    2c239973cf83a83982cb203a90e2017464bbfccd91ada6ad3abd6f07864d0cc2675241ad0bc10b92ef5a92035023e163940a76ab1bd2360c01783aadd46d9d2c

  • SSDEEP

    6144:+y+phFTwlTLfkixFUQKf3D7TnBAZ5qhbxK:7+pn0lYixsfvDBAzK9K

Score
10/10
remotecybergate

Malware Config

Extracted

Family

cybergate

Version

v1.11.0 - Public Version

Botnet

remote

C2

127.0.0.1:527

127.0.0.1:427
Mutex

YUKF0WI1GQ5VTE

Attributes
  • enable_keylogger

    true

  • enable_message_box

    true

  • ftp_directory

    ./logs

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    zzz

  • install_file

    install.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Your pc is not compatible for the program

  • message_box_title

    explorer.exe

  • password

    zakzak111

Signatures

  • Cybergate family
    cybergate
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • bec020fb05305a8bed7c385c3341af04_JaffaCakes118
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections