General
-
Target
af0cb06c251e25f519a762d6be4f87a4eee33b6caeecd5afd6e5da30a6d2da7d
-
Size
296KB
-
MD5
da28bfe864f65d6d158a849b65d85bad
-
SHA1
0302d4bde755d73618993bc8fa80a8f8b86888fc
-
SHA256
af0cb06c251e25f519a762d6be4f87a4eee33b6caeecd5afd6e5da30a6d2da7d
-
SHA512
15e1697a5a96dcf46e57447ff91a83cab45a4f75d046ae3bf0b56acfd25975902aeefc46aa3a7bc28832d8b6848b94736647005a219cd250536e22860448f0df
-
SSDEEP
6144:POpslFlqHhdBCkWYxuukP1pjSKSNVkq/MVJbF:PwslITBd47GLRMTbF
Score
10/10
Malware Config
Extracted
Family
cybergate
Version
v1.07.5
Botnet
W00t
C2
taco.no-ip.biz:82
Mutex
1EQM856400115P
Attributes
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
Winbooterr
-
install_file
Svchost.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
123456
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
Cybergate family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
af0cb06c251e25f519a762d6be4f87a4eee33b6caeecd5afd6e5da30a6d2da7d
Headers
Sections