Overview

overview

10

Static

static

10

JaffaCakes...b0.exe

windows7-x64

10

JaffaCakes...b0.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_d328f3a5f09787f7e5ce436946afe8b0

  • Size

    324KB

  • MD5

    d328f3a5f09787f7e5ce436946afe8b0

  • SHA1

    60d35e04b86ee259eb4b2eb9d7d00f452943391f

  • SHA256

    11d974cbb620ba40566b061fc0a590d1652e0a60fdb3defc64521589430e2ba0

  • SHA512

    977df47ccfbb77fbe4c039204930221e85a4622cc28b3a01345cc9260a4ffa8a138156cd6ca1c18266473b68aae157641edc4394ad9c45f58f04ffb81a81c605

  • SSDEEP

    6144:ZScrLx4mp8D6WGc/YSlIipBReubLzeh7Yy0DMIdeXijd:Ecmy78QSVnNyhsFMCeSjd

Score
10/10
viccybergate

Malware Config

Extracted

Family

cybergate

Version

v1.18.0 - Crack Version

Botnet

Vic

C2

hansdergraue.zapto.org:81

Mutex

0FYAJ5SXXSW16N

Attributes
  • enable_keylogger

    false

  • enable_message_box

    false

  • ftp_directory

    ./logs

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Hallo Dennis :>

  • message_box_title

    CyberGate

  • password

    123

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • Cybergate family
    cybergate
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • JaffaCakes118_d328f3a5f09787f7e5ce436946afe8b0
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections