Static

static

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    Sa777d.exe

  • Size

    427KB

  • MD5

    a9323c7e6e3213d3cf6f8c36d072af49

  • SHA1

    c180cb5b99d726333e5077c0271291337727ca8e

  • SHA256

    569a9e1f7fe5fa60891d25fe3b5e9327c00f9c35a3503689d632e66a8d505554

  • SHA512

    d7847ec7b026830f56a4b8b4ceeffc8aa3204230ae8de3db386036711d054d38d5d6fe82ad7a00a5084b71680409728b8032a29922ff539bdd31e8955bddf130

  • SSDEEP

    12288:puMwuBi8vvrHxVPKyv2m77sZB07FxObO32T:pHwX8vrx52t07FQaC

Score
10/10
dddcybergate

Malware Config

Extracted

Family

cybergate

Version

v3.4.2.2

Botnet

ddd

C2

23.84.85.170:5632

Mutex

OON4EK3B243DN8

Attributes
  • enable_keylogger

    true

  • enable_message_box

    true

  • ftp_directory

    ./logs

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Broke dude to windows falied

  • message_box_title

    Windows Error

  • password

    123

Signatures

  • Cybergate family
    cybergate
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • Sa777d.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections