General
-
Target
dcfbd53367f466171a5e3347926d9ccd_JaffaCakes118
-
Size
281KB
-
MD5
dcfbd53367f466171a5e3347926d9ccd
-
SHA1
60ac92358a2c5af3d6010c8dcdda9c138f5793d1
-
SHA256
19652b0f32875ce879d36565fa87d14a4854e0a972b26734d29f5d587963fa7e
-
SHA512
18d632aeac7c4b141b3858e23e636fb7573fee2028e7541b4f3be568d7f87228ac4671b79d5a26699d3cf1163af0fcc2b0ba6baec0f90ab7f7ae1f03d6ac8e17
-
SSDEEP
6144:Oy+phWTwlTLfkixFUQKf3D7TnBAZ5qhbxv:L+pE0lYixsfvDBAzK9v
Score
10/10
Malware Config
Extracted
Family
cybergate
Version
v1.11.0 - Public Version
Botnet
remote
C2
hackcpu.no-ip.biz:1337
Mutex
W56RA2SS541V2I
Attributes
-
enable_keylogger
true
-
enable_message_box
true
-
ftp_directory
./logs
-
ftp_interval
30
-
injected_process
svchost.exe
-
install_dir
Google
-
install_file
GoogleTBUUPDate.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
You are not a VIP member visit the site register and order vip for all your favorite hacks today!!
-
message_box_title
GameKiller Vip Status
-
password
no-ip
-
regkey_hkcu
Share
-
regkey_hklm
Rapid
Signatures
-
Cybergate family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
dcfbd53367f466171a5e3347926d9ccd_JaffaCakes118
Headers
Sections