Overview

overview

10

Static

static

10

bf16c90285...18.exe

windows7-x64

8

bf16c90285...18.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    bf16c902858bbb0ae55cfd4a7491ae91_JaffaCakes118

  • Size

    296KB

  • MD5

    bf16c902858bbb0ae55cfd4a7491ae91

  • SHA1

    94ccce795eba082835bcd595e3e1970719c7c91f

  • SHA256

    9034a0b70cf59977be65c58b78ababa3093aa4d9209ecf71babedb81d3dcf3a3

  • SHA512

    cd499ecb3727600e4a1c58462b9d7d64a0230256dd25a4b9b9bf6d5d6e782b6e73296596ecc9ccc97b525616967012f0d47041d6526a2faae07defb97fdf0ef8

  • SSDEEP

    6144:POpslFlqHhdBCkWYxuukP1pjSKSNVkq/MVJb4:PwslETBd47GLRMTb4

Score
10/10
remotecybergate

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

remote

C2

127.0.0.1:8080

shadab.zapto.org:8080
Mutex

20655XX8AM4758

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    c:\

  • install_file

    system32.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    123456789

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • Cybergate family
    cybergate
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • bf16c902858bbb0ae55cfd4a7491ae91_JaffaCakes118
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections