Overview

overview

10

Static

static

10

eec523c997...18.exe

windows7-x64

10

eec523c997...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    eec523c9971e3015d1879457fc925481_JaffaCakes118

  • Size

    289KB

  • MD5

    eec523c9971e3015d1879457fc925481

  • SHA1

    1979115840120ffbd92416e23906f7833dec42bc

  • SHA256

    8720d39ea0ce73ce01eb8f5f64211a33d4acdef9223188d72f19a915a101cba6

  • SHA512

    85f24a0e2928c24eeff5b765bd22b8729cea139367bfba547160511da0bb49c6913e698b6fc16baab99bbb46badecdda0ca51d4864408b6ac9e5673ca7afe4bf

  • SSDEEP

    6144:eOpslFlqfhdBCkWYxuukP1pjSKSNVkq/MVJb0:ewslATBd47GLRMTb0

Score
10/10
explodcybergate

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

eXpLoD

C2

bolundu2.no-ip.org:1324

Mutex

E0N50N3O32D47V

Attributes
  • enable_keylogger

    true

  • enable_message_box

    true

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    csrss.exe

  • install_file

    svchost.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Your OS is not supported by this application.

  • message_box_title

    Error

  • password

    cybergate

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • Cybergate family
    cybergate
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • eec523c9971e3015d1879457fc925481_JaffaCakes118
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections