Overview

overview

10

Static

static

10

ce93cbd739...18.exe

windows7-x64

10

ce93cbd739...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ce93cbd739ef54a8bdaaa8a3ece64b22_JaffaCakes118

  • Size

    331KB

  • MD5

    ce93cbd739ef54a8bdaaa8a3ece64b22

  • SHA1

    f3b52995619d377d2e76a6664bac13d2748c4349

  • SHA256

    3951c5dc75e12b1a32e43288ee70fa78d8a9c5ea15c25d2d4b559f8dc02df048

  • SHA512

    4e8047c70bbb510c319f3a13ac70f6d6551e6e67a459fba627498984b5baf6296b1f0495a0540554fba7a0b9d92f668800216ba2bfc2674ae97ccba630fa684e

  • SSDEEP

    6144:zOpslFlqcZ9L6H9BtVQhdBCkWYxuukP1pjSKSNVkq/MVJbo:zwslOTt6TBd47GLRMTbo

Score
10/10
vcybergate

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

v

C2

ratts123.no-ip.biz:3738

Mutex

702T657408CQE8

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    user.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    This package is not supported on this platform. Contact your application vendor.

  • message_box_title

    Error

  • password

    swedxya

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • Cybergate family
    cybergate
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • ce93cbd739ef54a8bdaaa8a3ece64b22_JaffaCakes118
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections