General
-
Target
11d8ab757a71526c15fed353c1dfcf2f_JaffaCakes118
-
Size
318KB
-
Sample
240626-nmhn3svhpj
-
MD5
11d8ab757a71526c15fed353c1dfcf2f
-
SHA1
ce94f8f90a87df548f3bf05f147fa31034dac4b6
-
SHA256
777280ff152f1e6ea83b642aa055a1bf010e3f939381ec1cdd2b457813105d72
-
SHA512
5864a722f3ce4f64a41863f5df3a9a9b77f13060f383a11ec7757c0265470d5cfef314e473aad7056fa552ffeeba34f48e9503f1ced695e63f5d95002aaac3e9
-
SSDEEP
6144:pOpslERlqhhdBCkWSzyEE81pjSKoW78U1bgibiDNX4k:pwslHTBJeH87GAf11beNXZ
Behavioral task
behavioral1
Sample
11d8ab757a71526c15fed353c1dfcf2f_JaffaCakes118.exe
Resource
win7-20240508-en
Malware Config
Extracted
cybergate
v1.07.0
remote
esam3at.no-ip.biz:246
W25020Q2UH182R
-
enable_keylogger
false
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
install
-
install_file
server.exe
-
install_flag
false
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
1234567
Targets
-
-
Target
11d8ab757a71526c15fed353c1dfcf2f_JaffaCakes118
-
Size
318KB
-
MD5
11d8ab757a71526c15fed353c1dfcf2f
-
SHA1
ce94f8f90a87df548f3bf05f147fa31034dac4b6
-
SHA256
777280ff152f1e6ea83b642aa055a1bf010e3f939381ec1cdd2b457813105d72
-
SHA512
5864a722f3ce4f64a41863f5df3a9a9b77f13060f383a11ec7757c0265470d5cfef314e473aad7056fa552ffeeba34f48e9503f1ced695e63f5d95002aaac3e9
-
SSDEEP
6144:pOpslERlqhhdBCkWSzyEE81pjSKoW78U1bgibiDNX4k:pwslHTBJeH87GAf11beNXZ
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-