General

  • Target

    216a90f0a34e0c20bb762bdcf31841f9_JaffaCakes118

  • Size

    452KB

  • MD5

    216a90f0a34e0c20bb762bdcf31841f9

  • SHA1

    4291e8d8bca08629253b5b59161554073d3733e5

  • SHA256

    c70292e284d209316289a012cacfb4fef3c0da3a3261db08b88f6ef9917b1e4c

  • SHA512

    9e6a15142c9fdaf2efab7ac483eb18847b2962435b358178ec6d5561ff55cc7d9d0bf9a4441bd4c81fbaa4e529e4b97bf70a89ee402066325ab175fcde5a122e

  • SSDEEP

    12288:hyMIk0vveIqMs09OUh2ptLE6R1RRNLW20JOKe:xIt2/MX0UEppzRRT0re

Score
10/10

Malware Config

Extracted

Family

cybergate

Botnet

TRUE

C2

ØØÎÙÏϼ¼êÕÎÈÉÝÐìÎÓÈÙßȼ¼êÕÎÈÉÝÐýÐÐÓß¼¼êÕÎÈÉÝÐúÎÙÙ¼¼¼ùÄÕÈìÎÓßÙÏϼ¼¼ðÏÝÿÐÓÏÙ¼¼ÿÎÅÌÈéÒÌÎÓÈÙßÈøÝÈݼ¼óÐÙõÒÕÈÕÝÐÕÆÙ¼¼¼ïÅÏúÎÙÙïÈÎÕÒÛ¼¼¼ìïÈÓÎÙÿÎÙÝÈÙõÒÏÈÝÒßÙ¼¼îÝÏùÒÉÑùÒÈÎÕÙÏý¼¼¼ïôûÙÈïÌÙßÕÝÐúÓÐØÙÎìÝÈÔý¼¼¼èÓýÏßÕÕ¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼AY2O7-J121-21HE-FIEU-63EEIG26V17Q}

HKLM

HKCU

TRUE

16

0

Steam Hack v16.2

Steam Hack v16.2 Failed to load!

FALSE

ftp.server.com

./logs/

ftp_user

ªš÷Öº+Þ

21

30

Mutex

Attributes
  • enable_keylogger

    false

  • enable_message_box

    true

  • install_dir

    TRUE

  • install_file

    TRUE

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    TRUE

  • message_box_title

    TRUE

  • password

    TRUE

  • regkey_hkcu

    TRUE

  • regkey_hklm

    TRUE

Signatures

  • Cybergate family
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unsigned PE 5 IoCs

    Checks for missing Authenticode signature.

Files

  • 216a90f0a34e0c20bb762bdcf31841f9_JaffaCakes118
    .rar
  • Steam Hack v16.2/Config.cfg
  • Steam Hack v16.2/Custom Key List.txt
  • Steam Hack v16.2/Info.txt
  • Steam Hack v16.2/Steam Hack v16.2.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • Steam Hack v16.2/Steam Hack v16.2.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • Steam Hack v16.2/msvcr71.dll
    .dll windows:4 windows x86 arch:x86

    7acc8c379c768a1ecd81ec502ff5f33e


    Headers

    Imports

    Exports

    Sections