Overview

overview

10

Static

static

10

04ad5316b1...18.exe

windows7-x64

10

04ad5316b1...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    04ad5316b11d04e2798e264bdfdc8d7f_JaffaCakes118

  • Size

    387KB

  • MD5

    04ad5316b11d04e2798e264bdfdc8d7f

  • SHA1

    9e211eeaede71ccad5648b6bc4ebaf7156ce69ee

  • SHA256

    ce77a5012356c8285b7152f226824a17164e2a963417cf409f7a8b3ec46d9b22

  • SHA512

    7181cafc9bad18b6076f3b888453e1d8c9a63bbef75171db0e10dd5f71da05534393ab7ff01f8e40ca08359d8829c7aec80edf12cfa650bee2c24fb633473c39

  • SSDEEP

    6144:POpslFlq2thTthehdBCkWYxuukP1pjSKSNVkq/MVJbC:PwslLzkTBd47GLRMTbC

Score
10/10
iluvdawidcybergate

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

iluvdawid

C2

iluvdawid.no-ip.org:80

iluvdawid.no-ip.org:888

iluvdawid.no-ip.org:899
Mutex

03UK128JPCK3QR

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    f13b.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    Netgear123

Signatures

  • Cybergate family
    cybergate
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 04ad5316b11d04e2798e264bdfdc8d7f_JaffaCakes118
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections