General
-
Target
JaffaCakes118_5b36b3995a5069b87122954451d6d160
-
Size
281KB
-
MD5
5b36b3995a5069b87122954451d6d160
-
SHA1
a8d27a0cb5b31e3a0421e5d0bcf34ebdae3baa15
-
SHA256
4c72d51ee9335fb2e8329f8154f33fb3733dc1d05739d37357ac1c0e2d5787e7
-
SHA512
b1f7fa2ce292465199b8d7cd0e403a13c33b6416f7694e79c97918bcdb47de70f2805151775e5e324653b5260512ad2874479a8aa817b5ca93ee56c0dfa55ad9
-
SSDEEP
6144:gScrLM4mp8D6WGc/YSlIipBReubLzeh7Yy0DMIdeXijL:xczy78QSVnNyhsFMCeSjL
Score
10/10
Malware Config
Extracted
Family
cybergate
Version
v1.18.0 - Crack Version
Botnet
Hacker
C2
ttttt.no-ip.org:999
Mutex
8O16A0RR43WCEC
Attributes
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs
-
ftp_interval
30
-
injected_process
dwm.exe
-
install_dir
dwm
-
install_file
dwm.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
999
-
regkey_hkcu
New
-
regkey_hklm
dwm
Signatures
-
Cybergate family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
JaffaCakes118_5b36b3995a5069b87122954451d6d160
Headers
Sections