General
-
Target
16a47a19de38ed95b26d35594714d14b_JaffaCakes118
-
Size
348KB
-
Sample
240627-tl3whsygqa
-
MD5
16a47a19de38ed95b26d35594714d14b
-
SHA1
16e654df7698e49df6f05019c59bbe35385df07f
-
SHA256
4108898d3c6b36c16e2398098f8c53a89e6f613b28ff0c06cb038b5a4998b8e0
-
SHA512
3834572252ef5fc07000d1fdd32fdda86186514bdee0a6067cc922a8fcee589ea07f45e94a5d21eaecef684d4a55d5f2d2800d0451dd3a7c1e0beeb9aeeae9ef
-
SSDEEP
6144:8Lp3Omlvq4PPmjQMERrP2hp+mX9qx+7EOEkCO0DXmQ+39ak1tk2u8jM:5A/PesLR7WYufYOhUYta0x7j
Static task
static1
Behavioral task
behavioral1
Sample
16a47a19de38ed95b26d35594714d14b_JaffaCakes118.exe
Resource
win7-20240221-en
Malware Config
Extracted
cybergate
2.6
ÖÍíÉ
127.0.0.1:288
***MUTEX***
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
svchost.exe
-
install_file
windows.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
texto da mensagem
-
message_box_title
t?tulo da mensagem
-
password
abcd1234
Targets
-
-
Target
16a47a19de38ed95b26d35594714d14b_JaffaCakes118
-
Size
348KB
-
MD5
16a47a19de38ed95b26d35594714d14b
-
SHA1
16e654df7698e49df6f05019c59bbe35385df07f
-
SHA256
4108898d3c6b36c16e2398098f8c53a89e6f613b28ff0c06cb038b5a4998b8e0
-
SHA512
3834572252ef5fc07000d1fdd32fdda86186514bdee0a6067cc922a8fcee589ea07f45e94a5d21eaecef684d4a55d5f2d2800d0451dd3a7c1e0beeb9aeeae9ef
-
SSDEEP
6144:8Lp3Omlvq4PPmjQMERrP2hp+mX9qx+7EOEkCO0DXmQ+39ak1tk2u8jM:5A/PesLR7WYufYOhUYta0x7j
-
Suspicious use of SetThreadContext
-