General
-
Target
fe0f49f4e2787c4b801f3c23d16bf13c_JaffaCakes118
-
Size
281KB
-
MD5
fe0f49f4e2787c4b801f3c23d16bf13c
-
SHA1
995cbcfcaf0874a6d0f6e5bcf01bc92b2479cf7f
-
SHA256
637e0edc5b237f1eb5ba1b9743341afead1395bcd643e9b168e12a3bed624d7b
-
SHA512
d9565f838968dd3a7b2b8130fba73877c75a95c27472ba597b3033b877f2488765ae33d12e6b2c9356c7153c50ebf2bb04ecd612bc4bd1ae8902551823f980ba
-
SSDEEP
6144:+y+ph0TwlTLfkixFUQKf3D7TnBAZ5qhbx7:7+pS0lYixsfvDBAzK97
Score
10/10
Malware Config
Extracted
Family
cybergate
Version
v1.11.0 - Public Version
Botnet
jenny909
C2
jenny909.zapto.org:1337
Mutex
R55C2K78DB17K8
Attributes
-
enable_keylogger
true
-
enable_message_box
true
-
ftp_directory
./logs
-
ftp_interval
30
-
injected_process
svchost.exe
-
install_dir
install
-
install_file
server.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
error !
-
message_box_title
CyberGate
-
password
wtfwtf
-
regkey_hkcu
bunny
-
regkey_hklm
funny
Signatures
-
Cybergate family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
fe0f49f4e2787c4b801f3c23d16bf13c_JaffaCakes118
Headers
Sections