Overview

overview

10

Static

static

10

c15a6c57e8...18.exe

windows7-x64

10

c15a6c57e8...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c15a6c57e82234475e01eb3fc931fe96_JaffaCakes118

  • Size

    296KB

  • MD5

    c15a6c57e82234475e01eb3fc931fe96

  • SHA1

    f677a8cfd0699ce94f1146202d4551786ae43af8

  • SHA256

    7fa9d49bbf4d2b9437210d185d0e59527a86429926ce5557f9a9e46909b5a3a9

  • SHA512

    219bd3057503b5505712a8da6b24c8594437c9c70d4d5caa770fcfd451a26e4df1d900df37999eefef2ea9b62cff69991795e48d58b75abe196212aac9d682bf

  • SSDEEP

    6144:POpslFlq3hdBCkWYxuukP1pjSKSNVkq/MVJbN:PwslGTBd47GLRMTbN

Score
10/10
sumcybergate

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

Sum

C2

freedomtech.no-ip.biz:82

Mutex

267R214XTO18SB

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    directory

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    salis123

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • Cybergate family
    cybergate
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • c15a6c57e82234475e01eb3fc931fe96_JaffaCakes118
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections