General

  • Target

    0963791800b79a261968c800bdbe935c_JaffaCakes118

  • Size

    391KB

  • Sample

    240620-zddvbawfkh

  • MD5

    0963791800b79a261968c800bdbe935c

  • SHA1

    1f76b1c9dbe597744f6410fe355d9836084dba81

  • SHA256

    18d8a17bd15af16ffd7aa9b28196aa46b2ea64d1134015bd5e20a6dcd3b24710

  • SHA512

    a4e450696638fa9355520dc46ae6a3f5c476279a47a7527becdc603f4165b80253443094203cded990a2f9b27bebbca9e4c2be7533ef4d6b951c3aac424e6d7e

  • SSDEEP

    12288:C9AtR8ACtTgyzYqDMIRQuEcnllh6ax0cVeUPt:GIuACtEyzyIRocnljHzImt

Malware Config

Extracted

Family

cybergate

Version

2.7 Beta 02

Botnet

ownerz

C2

46.245.207.117:81

Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    Font

  • install_file

    Tohama.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    s-hacker

  • regkey_hklm

    MIcorsoft Corproation

Targets

    • Target

      0963791800b79a261968c800bdbe935c_JaffaCakes118

    • Size

      391KB

    • MD5

      0963791800b79a261968c800bdbe935c

    • SHA1

      1f76b1c9dbe597744f6410fe355d9836084dba81

    • SHA256

      18d8a17bd15af16ffd7aa9b28196aa46b2ea64d1134015bd5e20a6dcd3b24710

    • SHA512

      a4e450696638fa9355520dc46ae6a3f5c476279a47a7527becdc603f4165b80253443094203cded990a2f9b27bebbca9e4c2be7533ef4d6b951c3aac424e6d7e

    • SSDEEP

      12288:C9AtR8ACtTgyzYqDMIRQuEcnllh6ax0cVeUPt:GIuACtEyzyIRocnljHzImt

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Tasks