Overview

overview

10

Static

static

10

17c2d438ca...18.exe

windows7-x64

10

17c2d438ca...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    17c2d438cafc85a033e2c0b2d6efdd6a_JaffaCakes118

  • Size

    276KB

  • MD5

    17c2d438cafc85a033e2c0b2d6efdd6a

  • SHA1

    210a33c3d21e91255a4f4d8fb503e3825ae8fcab

  • SHA256

    d9dba881e4655c7e1b0a215105cc4a440cccd02488c78750bc0f6563fa2a15bd

  • SHA512

    f1267eba8e95afcf14653520fe5537600636f851395ac22cdb1e2c3e5e7f1c0f402183ef29b094947add5829d2a9192b84808a21411630b7ecef409d9f30187d

  • SSDEEP

    6144:P4ABF949pAuO/50BTnqPd0Mpz7qhh4nXjjf8MZ9BKXK1:AUvGLE0kuGnESB1

Score
10/10
remotecybergate

Malware Config

Extracted

Family

cybergate

Version

v1.04.8

Botnet

remote

C2

buy.kicks-ass.net:22

Mutex

6YV416XF778L6V

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    master

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • Cybergate family
    cybergate
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 17c2d438cafc85a033e2c0b2d6efdd6a_JaffaCakes118
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections