Overview

overview

10

Static

static

10

76f9f629db...18.exe

windows7-x64

10

76f9f629db...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    76f9f629db85e48a27f9b10e062b9253_JaffaCakes118

  • Size

    324KB

  • MD5

    76f9f629db85e48a27f9b10e062b9253

  • SHA1

    3f4939373199911ee01754ca6da4c466bb07b89c

  • SHA256

    460fb7698044db8d82fc0bac7a910c80ee2e3dbda4386fb7657606909390e84d

  • SHA512

    19d31af5da35624f58af12c868747f15bf8ecc734b423115095e909ccc67d02fd89b86504e8141a985729eeb3514c9c774bffc18047d4962e55a3daeceafed9f

  • SSDEEP

    6144:QmcD66RRX5JGmrpQsK3RD2u270jupCJsCxCYAYFwk:ZcD66iZ2zkPaCxXwk

Score
10/10
vítimacybergate

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

vítima

C2

abdelhadi-touaf.zapto.org:81

abdelhadi12.zapto.org:81

aziza12.zapto.org:81
Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

Signatures

  • Cybergate family
    cybergate
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 76f9f629db85e48a27f9b10e062b9253_JaffaCakes118
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections