Overview

overview

10

Static

static

10

66b82fc474...0N.exe

windows7-x64

10

66b82fc474...0N.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    66b82fc4740b0ea737d82750530b9720N

  • Size

    275KB

  • MD5

    66b82fc4740b0ea737d82750530b9720

  • SHA1

    88fd261adb3909ae7447732d28fe90c881b20f22

  • SHA256

    3d94250c16d0d8a53775ffed8d1e49758f6cd8768964b458c9e7b4909b0be79b

  • SHA512

    6eaaf0ac0396721b9aeb9edc9524b5039ababcc07d3bc20e6103f16cb5a83901ed24417c78a41c5ee232a81432e3e89a482e43c5936e6e3f1b897cd2b685c77b

  • SSDEEP

    6144:fxJsGLn7XoxDNT/xQphU+jrlgzfuzt91C9NDyWId98HhqbxtHGZx:JJsGvX4h/xQp6+tqOYy9zo0k

Score
10/10
btfscybergate

Malware Config

Extracted

Family

cybergate

Version

v1.02.1

Botnet

btfs

C2

178.63.41.5:47539

Mutex

svchost

Attributes
  • enable_keylogger

    false

  • enable_message_box

    false

  • ftp_directory

    ./

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    Microsoft

  • install_file

    svchost.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    VOCÊ FOI HACKEADO ...SEU SISTEMA SERÁ FORMATADO.

  • message_box_title

    LAMMER

  • password

    audirs4

  • regkey_hkcu

    Ms64

  • regkey_hklm

    Ms64

Signatures

  • Cybergate family
    cybergate
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 66b82fc4740b0ea737d82750530b9720N
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections