General
-
Target
e2805cfff9fffd24e6abdfce3643afad_JaffaCakes118
-
Size
384KB
-
MD5
e2805cfff9fffd24e6abdfce3643afad
-
SHA1
41dfe280ebe57e14ff895a7e840b6f81ef6e78fa
-
SHA256
b21ec2cfa8df0939c00e000b35e659c8e9f332ed29f190be6ba116f5396b5679
-
SHA512
426940b2d73716a6c93e8f5ae82e947e5ba538048e9dffcd5e3cb399888a7ecbac5bd305fe1d1fde1bb3b2c8681cd35af4e2bd5303f3a70d2f2ff4abc2768fad
-
SSDEEP
6144:E4ABF94PpAuO/50BTnqPd0Mpz7qhh4nXjjf8MZ9BKXKjhTyfVDoTC/kNXLq:bUdGLE0kuGnESBRy9olq
Score
10/10
Malware Config
Extracted
Family
cybergate
Version
v1.04.8
Botnet
remote
C2
omega2.no-ip.biz:81
Mutex
EDQT5LDPW3IX05
Attributes
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
win
-
install_file
system32.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
cybergate
-
regkey_hkcu
system
-
regkey_hklm
system
Signatures
-
Cybergate family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
e2805cfff9fffd24e6abdfce3643afad_JaffaCakes118
Headers
Sections