Overview

overview

10

Static

static

10

70fc5dc05b...cN.exe

windows7-x64

10

70fc5dc05b...cN.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    70fc5dc05b36876fb95906bae08ed4e69323caaec44771be9520d7eafd20940cN

  • Size

    1.1MB

  • MD5

    2964d7f53721ad0199340371042bc480

  • SHA1

    b7a2ca5634629977ea92d04599ab6439c6d14795

  • SHA256

    70fc5dc05b36876fb95906bae08ed4e69323caaec44771be9520d7eafd20940c

  • SHA512

    7dd8b049fa801059579d3d9e5c5f62b5546946690186a5bd35f8b524716491abec1dee01336ef57f6ed6201ffc4872647cb8abcb6cb28c9db3b81229419ddc98

  • SSDEEP

    24576:PslGME4IoAGAVME4IoAGAVME4IoAGALd474mfM:Psm4IoAGs4IoAGs4IoAGSOPfM

Score
10/10
remotecybergate

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

remote

C2

jal6h.no-ip.biz:81

Mutex

3DPN40AF8G7WX3

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • ftp_password

    ªš÷Öº+Þ

  • ftp_port

    21

  • ftp_server

    ftp.server.com

  • ftp_username

    ftp_user

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    true

  • message_box_caption

    Error in the system files you must run the assistant to complete the process

  • message_box_title

    Billiards add point

  • password

    6111990

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • Cybergate family
    cybergate
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 70fc5dc05b36876fb95906bae08ed4e69323caaec44771be9520d7eafd20940cN
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections