Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

da28bfe864...18.exe

windows7-x64

10

da28bfe864...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    da28bfe864f65d6d158a849b65d85bad_JaffaCakes118

  • Size

    296KB

  • MD5

    da28bfe864f65d6d158a849b65d85bad

  • SHA1

    0302d4bde755d73618993bc8fa80a8f8b86888fc

  • SHA256

    af0cb06c251e25f519a762d6be4f87a4eee33b6caeecd5afd6e5da30a6d2da7d

  • SHA512

    15e1697a5a96dcf46e57447ff91a83cab45a4f75d046ae3bf0b56acfd25975902aeefc46aa3a7bc28832d8b6848b94736647005a219cd250536e22860448f0df

  • SSDEEP

    6144:POpslFlqHhdBCkWYxuukP1pjSKSNVkq/MVJbF:PwslITBd47GLRMTbF

Score
10/10
w00tcybergate

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

W00t

C2

taco.no-ip.biz:82

Mutex

1EQM856400115P

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    Winbooterr

  • install_file

    Svchost.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    123456

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • Cybergate family
    cybergate
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • da28bfe864f65d6d158a849b65d85bad_JaffaCakes118
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.