Overview

overview

10

Static

static

10

10860e325b...18.exe

windows7-x64

10860e325b...18.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

  • Target

    10860e325b2a7a9ce09cc7557049cd50_JaffaCakes118

  • Size

    164KB

  • MD5

    10860e325b2a7a9ce09cc7557049cd50

  • SHA1

    347293fc338573a047770746f9e1bbaa4892a72d

  • SHA256

    b72ada6de0836b3033d3066ddc00393a4b6fd5f8b3ea87fa95080f8e8a7a230d

  • SHA512

    6788046d37a86109a695114023a9ad78b75a7688c6e5d34d0d9d8c3ec6d5dc0f6a03157c2c57a43f34131ea10bd49499f7062109ed7b57d1123d384d14843ddd

  • SSDEEP

    3072:liGpszcJsGZRnM3ZI3HwSDE/dVCT/I4pyFphUXxAGi2J41g+u1gJgIZkfcx0/X0L:/xJsGLnKoxDNT/xQphU+jrlgzfuztR

Score
10/10
bckcfcybergate

Malware Config

Extracted

Family

cybergate

Version

v1.01.12

Botnet

bckcf

C2

127.0.0.1:999

hackedbich.no-ip.org:3460
Mutex

CyberGate1

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    Winrarr

  • install_file

    Winrarr.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    12354v1bf

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • Cybergate family
    cybergate
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 10860e325b2a7a9ce09cc7557049cd50_JaffaCakes118
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections