Overview

overview

10

Static

static

10

ce68d8e778...18.exe

windows7-x64

10

ce68d8e778...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    ce68d8e778a3bd9d34f576cfbc26217c_JaffaCakes118

  • Size

    290KB

  • MD5

    ce68d8e778a3bd9d34f576cfbc26217c

  • SHA1

    34a17af307fbe78d2947dcc914fdcf135338e5f3

  • SHA256

    d0a49ff3abe7ee11bf25a0e27685959859b123acc65b700c3cf33f3fa6feff4a

  • SHA512

    8cacdf98a7294b7b22e8b0cbd93d2f893302c883aef2684c5ebfe685dded0b4023d253085576bab3a424a0e7435d03aad779162b860cefa2670677ade6df1393

  • SSDEEP

    6144:NmcD66R7X5JGmrpQsK3RD2u270jupCJsCxC:YcD66MZ2zkPaCx

Score
10/10
spy26srvcybergate

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

Spy26srv

C2

toritoguay.no-ip.org:3460

spawn007.no-ip.biz:3460
Mutex

***MUTEX***

Attributes
  • enable_keylogger

    false

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    Spy-Net

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • password

    120900

  • regkey_hkcu

    HKCU

Signatures

  • Cybergate family
    cybergate
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • ce68d8e778a3bd9d34f576cfbc26217c_JaffaCakes118
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections