General
-
Target
fb67c53c484409b2d6490cf28df66cf5_JaffaCakes118
-
Size
485KB
-
Sample
240419-3fk8ysac64
-
MD5
fb67c53c484409b2d6490cf28df66cf5
-
SHA1
1aec96649a837936e3e0fcad1efbb0c6659f1ee9
-
SHA256
ef478034153fffe4fa48a2e14270344f2822b23451578e057ba973b5cd00208b
-
SHA512
cb50a2b27a8e2a1e19e02838880b8e099c3328541cfe9f2b1cb318aa1aafa29484267182f577a8837b86b9790f00901090600da767f68c49bfb6b1434bb6bb4f
-
SSDEEP
12288:eQJCigG/L1CtPeNMP9Er7sK9eQI05wfYMK:eQJC2DgtPeNMisK9eQI05tM
Static task
static1
Behavioral task
behavioral1
Sample
fb67c53c484409b2d6490cf28df66cf5_JaffaCakes118.exe
Resource
win7-20231129-en
Malware Config
Extracted
cybergate
v1.18.0 - Crack Version
Magic
magicfuny12.publicvm.com:1200
S1SJ2M4JDDUT62
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
Windouis
-
install_file
system32.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
2211302
Targets
-
-
Target
fb67c53c484409b2d6490cf28df66cf5_JaffaCakes118
-
Size
485KB
-
MD5
fb67c53c484409b2d6490cf28df66cf5
-
SHA1
1aec96649a837936e3e0fcad1efbb0c6659f1ee9
-
SHA256
ef478034153fffe4fa48a2e14270344f2822b23451578e057ba973b5cd00208b
-
SHA512
cb50a2b27a8e2a1e19e02838880b8e099c3328541cfe9f2b1cb318aa1aafa29484267182f577a8837b86b9790f00901090600da767f68c49bfb6b1434bb6bb4f
-
SSDEEP
12288:eQJCigG/L1CtPeNMP9Er7sK9eQI05wfYMK:eQJC2DgtPeNMisK9eQI05tM
-
Adds policy Run key to start application
-
Modifies Installed Components in the registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-