General
-
Target
f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118
-
Size
178KB
-
Sample
240417-3sqdfaab43
-
MD5
f6d5441c8b32fe2a58a8d1a4a9315a50
-
SHA1
bc7adca0427485eb93cc134545599086291cf007
-
SHA256
e212ea2877c9481bac38846784c7cec3e4b97336455ce8db9566a86f49ac55fb
-
SHA512
56407cb4192d38c23c6fb41199deb0f7a729aaf4dc65fc15b593078aca0d6cd4bf5624c4e2c600951d2503f50b40c1f77be1360487cbfc0724ccb5b7c86a3366
-
SSDEEP
3072:KltXqnLYlQ2OJpZeEVLgp9zySBZBMEBYgkwGD9SmRdvtN10W2oYZKbSLY2mc:Kr2YlQ2gjcp9eEFYgkwGRRZtfV2nZKuL
Behavioral task
behavioral1
Sample
f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118.exe
Resource
win7-20240221-en
Malware Config
Extracted
cybergate
2.2.2
av
10.255.100.220:81
127.0.0.1:81
***MUTEX***
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
.//
-
ftp_interval
5
-
ftp_password
$%&key&%$
-
ftp_port
21
-
ftp_server
10.255.100.220
-
ftp_username
keykey
-
injected_process
explorer.exe
-
install_dir
install
-
install_file
rcart.exe
-
install_flag
true
-
keylogger_enable_ftp
true
-
message_box_caption
texto da mensagem
-
message_box_title
tÃtulo da mensagem
-
password
keykey
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Targets
-
-
Target
f6d5441c8b32fe2a58a8d1a4a9315a50_JaffaCakes118
-
Size
178KB
-
MD5
f6d5441c8b32fe2a58a8d1a4a9315a50
-
SHA1
bc7adca0427485eb93cc134545599086291cf007
-
SHA256
e212ea2877c9481bac38846784c7cec3e4b97336455ce8db9566a86f49ac55fb
-
SHA512
56407cb4192d38c23c6fb41199deb0f7a729aaf4dc65fc15b593078aca0d6cd4bf5624c4e2c600951d2503f50b40c1f77be1360487cbfc0724ccb5b7c86a3366
-
SSDEEP
3072:KltXqnLYlQ2OJpZeEVLgp9zySBZBMEBYgkwGD9SmRdvtN10W2oYZKbSLY2mc:Kr2YlQ2gjcp9eEFYgkwGRRZtfV2nZKuL
-
Adds policy Run key to start application
-
Modifies Installed Components in the registry
-
Adds Run key to start application
-