General
-
Target
JaffaCakes118_7adf4f28365de0e6079041df43c12ace
-
Size
296KB
-
MD5
7adf4f28365de0e6079041df43c12ace
-
SHA1
f621dfee15f80bb5f1eff21c7529bcc01f48b96f
-
SHA256
f53167dddfdb232fe47a72fa07cfdbe5cb9d8ef2255e12730d9af489d8583e7f
-
SHA512
9fafc23c4b68f6edd827022175e275aed005f5c4deeb4a2c42e52f94f18ddeb7ea58d0a555d1b4b43a8b1359cea887eb34f3e5bd788c28a4949ff1c805cd866e
-
SSDEEP
6144:NOpslw5hdBCkWYxuukP1pjSKSNVkq/MVJb:NwslwTBd47GLRMTb
Score
10/10
Malware Config
Extracted
Family
cybergate
Version
v1.07.5
Botnet
Cyber
C2
lodoclan.servegame.com:910
Mutex
ENO87DXACKRWW7
Attributes
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
winlogon
-
install_file
winlogon.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
fuckthat
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
Cybergate family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
JaffaCakes118_7adf4f28365de0e6079041df43c12ace
Headers
Sections