Overview

overview

10

Static

static

10

8defc2864d...28.exe

windows7-x64

1

8defc2864d...28.exe

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    8defc2864d5798f693bdc40bef70dab7e0a02cf5e9e5ceb38c3dd2201bb1a928

  • Size

    391KB

  • MD5

    bb74533333dcc35e32bbd87db954ea19

  • SHA1

    44d4e1d7097cf39416d423c4f94577ab0011054a

  • SHA256

    8defc2864d5798f693bdc40bef70dab7e0a02cf5e9e5ceb38c3dd2201bb1a928

  • SHA512

    9ab6322005b2f2caa575f709c013679515accdd728f71ff3d99f6d61e2ee54548d5092ab44be5a3123d7cca2d4b76d4a033d3a2546b2090094edf823b28f8604

  • SSDEEP

    6144:2mcD66RjCVbNdweNwMWjDy5JGmrpQsK3RD2u270jupCJsCxC:jcD66aNWeNwhDrZ2zkPaCx

Score
10/10
myprohackercybergate

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

myprohacker

C2

ns1server.zapto.org:85

Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    Win_fix

  • install_file

    Fix.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    Azri281295

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • Cybergate family
    cybergate
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 8defc2864d5798f693bdc40bef70dab7e0a02cf5e9e5ceb38c3dd2201bb1a928
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections