General
-
Target
JaffaCakes118_60941bd4c2ecca8e8db67fd193d1c880
-
Size
428KB
-
MD5
60941bd4c2ecca8e8db67fd193d1c880
-
SHA1
8d5fc3f6ca8cc67c4a0151f5a9a5e11c04b35935
-
SHA256
88ab42e4738d49d40c862c00bd7432aab8af1643dcfff3dffde04aadd56ead6a
-
SHA512
58e730c3751b5661a772093775f31dacc479672998d41c97eb6aaf0e504cba75baa1695372bea9072fbf2771e0df0e827f6ba9d2f20a4ba0ca9e109e89e276b4
-
SSDEEP
12288:huMwgBi8vvrHxVPKyv2m77sZB07FxObO32A:hHwB8vrx52t07FQar
Score
10/10
Malware Config
Extracted
Family
cybergate
Version
v3.4.2.2
Botnet
remote
C2
178.203.128.219:80
Mutex
YB8AI64F2VEEQN
Attributes
-
enable_keylogger
true
-
enable_message_box
true
-
ftp_directory
./logs
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
install
-
install_file
server.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
cybergate
Signatures
-
Cybergate family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
JaffaCakes118_60941bd4c2ecca8e8db67fd193d1c880
Headers
Sections