Overview

overview

10

Static

static

10

c2754c7ef9...18.exe

windows7-x64

10

c2754c7ef9...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    c2754c7ef93db72ebdec804a453c2ca1_JaffaCakes118

  • Size

    191KB

  • MD5

    c2754c7ef93db72ebdec804a453c2ca1

  • SHA1

    5033d43a7dfd834e0427d618eddde55da8ab7d2f

  • SHA256

    1cf6bec10340f7eed8fc650f7f8868d58c158553fb5a82a9a3c988c49d559971

  • SHA512

    4224f6740e677fa7c613b079ce641a9e9e12cdd9a2b5557216e5fd34343a6419d355ba811eedcfe20d1744908c1b424a2d317183bebeba06197b5a6068a4e82b

  • SSDEEP

    3072:0lt0bI9TbqOhxaoRWtQan7vG+L+igjEyPHaCKaB/Z3qAoBn64lDhzTBNRN7twP:0rjb9Wx7G+yiU5PH1K69FA1BNk

Score
10/10
upxwaseemcybergate

Malware Config

Extracted

Family

cybergate

Version

2.3

Botnet

waseem

C2

waseem12.homelinux.net:82

Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    waseem

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • Cybergate family
    cybergate
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • c2754c7ef93db72ebdec804a453c2ca1_JaffaCakes118
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections