Overview

overview

10

Static

static

10

Hack compt...am.exe

windows7-x64

10

Hack compt...am.exe

windows10-2004-x64

10

Hack compt...e3.dll

windows7-x64

7

Hack compt...e3.dll

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    d593a5d6558a2ea2768d9862983c76c0_JaffaCakes118

  • Size

    901KB

  • MD5

    d593a5d6558a2ea2768d9862983c76c0

  • SHA1

    826ea32d07eb0a54d0d1823b542c205cc270a2be

  • SHA256

    fbed47d48b5852f0e243ed1c5675a9baccd7a5a27e20454d53eddc8975667456

  • SHA512

    cd4b5d2900f121efd2670a2686d23354cb635ca9f51e33cdb5d1dd544bd3ddb59b5e71c829ee08a1217dd519cef7b9fc4d0248f7e1e6363818868b7e0ec4c232

  • SSDEEP

    24576:6zq+LtXVERKGMUT7ZaclhgV6x74YW6XR9WMdvXaPN:6zq+xXVyKGMc7MUQ6JXmM5YN

Score
10/10
vítimaupxcybergate

Malware Config

Extracted

Family

cybergate

Version

2.7 Final

Botnet

vítima

C2

78.243.80.47:80

78.243.80.47:81

78.243.80.47:82

78.243.80.47:83

geekattitude.dyndns-ip.com:80

geekattitude.dyndns-ip.com :81

geekattitude.dyndns-ip.com :82

geekattitude.dyndns-ip.com :83

192.168.0.16:80

192.168.0.16:81

192.168.0.16:82

192.168.0.16:83
Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    true

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    Hack comptes Steam

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Nous sommes en train de vous séléctionner un compte Steam à partir de notre base de données. VEUILLEZ PATIENTEZ. . . . . . . . . . . . . . . . . . . . . . . . . . . . .

  • message_box_title

    Hack comptes Steam

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • Cybergate family
    cybergate
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 3 IoCs

    Checks for missing Authenticode signature.

Files

  • d593a5d6558a2ea2768d9862983c76c0_JaffaCakes118
    .rar
  • Hack comptes Steam/!! IMPORTANT - Explication et Tuto.txt
  • Hack comptes Steam/Data & Database/Database.txt
  • Hack comptes Steam/Hack comptes Steam.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • Hack comptes Steam/mozsqlite3.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections