General
-
Target
bdedbddd89e666d6e95e52652e5a4059_JaffaCakes118
-
Size
290KB
-
MD5
bdedbddd89e666d6e95e52652e5a4059
-
SHA1
a4a4e994876c8a0192b632c197dfebd5c7c19205
-
SHA256
064a2fd07ac77925129ed7e819de03c3451398bd4b667db6ad5390c01c79b79e
-
SHA512
8be2930ad7a790c6881c98a313dca632341b398c4f9f7e855d4cf054814af21e8b1d1f42cf5267e4b9e0d7d98a234107eee30f6607510f4f913486a6d8fe0594
-
SSDEEP
6144:2OpslFlqYhdBCkWYxuukP1pjSKSNVkq/MVJbW:2wsl1TBd47GLRMTbW
Score
10/10
Malware Config
Extracted
Family
cybergate
Version
v1.07.5
Botnet
remote
C2
trevor761.no-ip.biz:81
gage761.no-ip.biz:81
Mutex
HX55C604C8VPQH
Attributes
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
WindowsUpdate
-
install_file
WindowsUpdate.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
cybergate
Signatures
-
Cybergate family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
bdedbddd89e666d6e95e52652e5a4059_JaffaCakes118
Headers
Sections