General
-
Target
cfd6b6134e6793fa50d923c63caf58de_JaffaCakes118
-
Size
281KB
-
MD5
cfd6b6134e6793fa50d923c63caf58de
-
SHA1
160c715d205e4bebcee0c84ce24135350d779f2f
-
SHA256
ceea0d1bfcddb4d1ebd77642094f5f7184ed4a6f0b0f091b0f199715428cb5ba
-
SHA512
c691d04c5703e4cf7d31a4e0c2720a842053c599bcb2cd05da8abaeb6560439cc2c53afd1f1cf8c2a9b75d45426efbf1672bd9fda9479e47b69e5e353fbecd95
-
SSDEEP
6144:NScrLF4mp8D6WGc/YSlIipBReubLzeh7Yy0DMIdeXijk:4ciy78QSVnNyhsFMCeSjk
Score
10/10
Malware Config
Extracted
Family
cybergate
Version
v1.18.0 - Trial version
Botnet
Andrax03-16-12
C2
gp1990.no-ip.org:1990
Mutex
Q00W3PR166L34H
Attributes
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
Winzip
-
install_file
Windll.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
gp161990
-
regkey_hkcu
Windll
-
regkey_hklm
Windll
Signatures
-
Cybergate family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
cfd6b6134e6793fa50d923c63caf58de_JaffaCakes118
Headers
Sections