General
-
Target
JaffaCakes118_a3d09fa0908b40eb889871a52432417a
-
Size
281KB
-
MD5
a3d09fa0908b40eb889871a52432417a
-
SHA1
67906174b22ede1dc6c644732bd86f7e9f6bf4c7
-
SHA256
14255b394f2df0d92a897fbec53659df39109c89644f98c062dc609319c896fe
-
SHA512
946da3cc5ba5ca5a18d87641bfe4cf6479bc6cbe16fcb0e7a2484f41b4cd5714cdfacfc0873d45aacad7fe5e1f118d827f693377f31d8141983bc9130fba18e5
-
SSDEEP
6144:AScrDq4mp8D6WGc/YSlIipBReubLzeh7Yy0DMIdeXijV:RcNy78QSVnNyhsFMCeSjV
Score
10/10
Malware Config
Extracted
Family
cybergate
Version
v1.18.0 - Crack Version
Botnet
remote
C2
127.0.0.1:7777
Mutex
M4Y1W5K2U13732
Attributes
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs
-
ftp_interval
30
-
injected_process
svchost.exe
-
install_dir
install
-
install_file
server.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
192790
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
Cybergate family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
JaffaCakes118_a3d09fa0908b40eb889871a52432417a
Headers
Sections