cybergate | jaffacakes118_43c2b8d8b4d391040387f0bfaf3aa727cdf6e458cdc88a2c0755551bbc9652a1[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_43c2b8d8b4d391040387f0bfaf3aa727cdf6e458cdc88a2c0755551bbc9652a1.bin
Size 457KB
Sample261002-jpp4qaxdrc
SHA256 43c2b8d8b4d391040387f0bfaf3aa727cdf6e458cdc88a2c0755551bbc9652a1
MD5 ffd94e1a99583a739a17924fbee8d9cc
SHA1 40d0f1a3ef994607e60fd46be59ee8e08ac367c1
SHA512 7b108e72abe88f3c3f99c2048a683bf2b03b284294ef63736ffd9996ed403542a0c342bd35f8de86cf05f6bbdd341ad187bd013a1aad417bb9da76532b9aab57
SSDEEP 6144:LmcD66R78LRvee4LRveeNTYZ35JGmrpQsK3RD2u270jupCJsCxC:ScD66k3O3NTYZGZ2zkPaCx
TLSH
T159A47C73CE00FC32DDAE887CEC5782D4BAD71EC1B16D57839B907A25C49A662C74825B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

vítima trojan stealer cybergate

Malware Config

Extracted

Family

cybergate

Version

Botnet

vítima

soonyextreme.ddns.net:1177

Mutex

***MUTEX***

Attributes

enable_keylogger
true
enable_message_box
true
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
install
install_file
svchost.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
O Programa não pode abrir no seu pc !
message_box_title
Error 404
password
123
regkey_hkcu
Team Viewer
regkey_hklm
CCLeaner

Signatures

Family: CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_43c2b8d8b4d391040387f0bfaf3aa727cdf6e458cdc88a2c0755551bbc9652a1.bin

File Explorer

jaffacakes118_43c2b8d8b4d391040387f0bfaf3aa727cdf6e458cdc88a2c0755551bbc9652a1.bin

.exe 457KB

jaffacakes118_43c2b8d8b4d391040387f0bfaf3aa727cdf6e458cdc88a2c0755551bbc9652a1.bin

SHA256 43c2b8d8b4d391040387f0bfaf3aa727cdf6e458cdc88a2c0755551bbc9652a1
MD5 ffd94e1a99583a739a17924fbee8d9cc
SHA1 40d0f1a3ef994607e60fd46be59ee8e08ac367c1
SHA512 7b108e72abe88f3c3f99c2048a683bf2b03b284294ef63736ffd9996ed403542a0c342bd35f8de86cf05f6bbdd341ad187bd013a1aad417bb9da76532b9aab57
SSDEEP 6144:LmcD66R78LRvee4LRveeNTYZ35JGmrpQsK3RD2u270jupCJsCxC:ScD66k3O3NTYZGZ2zkPaCx
TLSH
T159A47C73CE00FC32DDAE887CEC5782D4BAD71EC1B16D57839B907A25C49A662C74825B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

48116

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

44KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

1024B

Virtual Size

544B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

404KB

Virtual Size

403KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

jaffacakes118_43c2b8d8b4d391040387f0bfaf3aa727cdf6e458cdc88a2c0755551bbc9652a1.bin

generic