Overview

overview

10

Static

static

10

efa091c1f9...18.exe

windows7-x64

10

efa091c1f9...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    efa091c1f9d7e8fe4fc9df1c6b33a1c8_JaffaCakes118

  • Size

    296KB

  • MD5

    efa091c1f9d7e8fe4fc9df1c6b33a1c8

  • SHA1

    497ed2525bc807d33ffd06d2ae0191fb8fe23fe4

  • SHA256

    729d1fb9d54aaf6542de4e7cd8c377b6ed78677c9007af9106c00611e09976f7

  • SHA512

    e15fc8bfa46f7f5245416237543a78ede85acaa8bb735dedbec009930724831307c0e55e4be6b7bfee53a636dd90f8916487fe8419fdd35a14b0144ef5666502

  • SSDEEP

    6144:/OpslFlqahdBCkWYxuukP1pjSKSNVkq/MVJbk:/wslzTBd47GLRMTbk

Score
10/10
onlinecybergate

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

Online

C2

178.119.35.147:25565

Mutex

B52520BYK7F8YA

Attributes
  • enable_keylogger

    true

  • enable_message_box

    true

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    Afbeeldingen

  • install_file

    photo.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Deze afbeelding kon niet worden geopend. Neem contact op met de service.

  • message_box_title

    CyberGate

  • password

    1

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • Cybergate family
    cybergate
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • efa091c1f9d7e8fe4fc9df1c6b33a1c8_JaffaCakes118
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections