General
-
Target
fb04395ceedc0225cd495e7a3768dcb6_JaffaCakes118
-
Size
281KB
-
Sample
240419-x85keadd74
-
MD5
fb04395ceedc0225cd495e7a3768dcb6
-
SHA1
6b671c45cab9a107aefd36555b7a0aa79c50a680
-
SHA256
aef368967a2fae271d9342c1db4dccf0d326cdde7203b63d899603aee05cb9ec
-
SHA512
a5a76ef7966c9f7d1e918a82fe34334c57c3427bd7e819f50a0057007d9a8db4242de17be03718a0bf634bdf9aff1c519e8b5624a9f947fc6b922eb31a1e31ef
-
SSDEEP
6144:+y+ph+TwlTLfkixFUQKf3D7TnBAZ5qhbxY:7+pQ0lYixsfvDBAzK9Y
Behavioral task
behavioral1
Sample
fb04395ceedc0225cd495e7a3768dcb6_JaffaCakes118.exe
Resource
win7-20240220-en
Malware Config
Extracted
cybergate
v1.11.0 - Public Version
Cyber
tj888.no-ip.biz:25565
7K3PKBYCC54KE1
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs
-
ftp_interval
30
-
injected_process
taskmgr.exe
-
install_dir
Microsoft
-
install_file
WindowsUpdater.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
ARE YOU GAY LOL? YOU MAD? YOU HAVE TO CLICK OK SO YOU ARE LOL!
-
message_box_title
CyberGate
-
password
123456
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Targets
-
-
Target
fb04395ceedc0225cd495e7a3768dcb6_JaffaCakes118
-
Size
281KB
-
MD5
fb04395ceedc0225cd495e7a3768dcb6
-
SHA1
6b671c45cab9a107aefd36555b7a0aa79c50a680
-
SHA256
aef368967a2fae271d9342c1db4dccf0d326cdde7203b63d899603aee05cb9ec
-
SHA512
a5a76ef7966c9f7d1e918a82fe34334c57c3427bd7e819f50a0057007d9a8db4242de17be03718a0bf634bdf9aff1c519e8b5624a9f947fc6b922eb31a1e31ef
-
SSDEEP
6144:+y+ph+TwlTLfkixFUQKf3D7TnBAZ5qhbxY:7+pQ0lYixsfvDBAzK9Y
-
Adds policy Run key to start application
-
Modifies Installed Components in the registry
-
Adds Run key to start application
-