General
-
Target
232645072140c854824be5e2e6eacfb5_JaffaCakes118
-
Size
281KB
-
Sample
240703-vnpmcazbkk
-
MD5
232645072140c854824be5e2e6eacfb5
-
SHA1
7ec271db1889aac517f08b804c8f9556de4be1a1
-
SHA256
7051ee514c09d86ae0392cd7530066c1b82e740c7635dd7ef1a17de73de7513f
-
SHA512
14cf74ffff7e084c4551be6b3384c7eeb8f564120dcfd54fed865fad7666240c1007bec14d07793a1fbca6a720720a042ee009a4db3aab58f6402421c6813b84
-
SSDEEP
6144:uy+phcTwlTLfkixFUQKf3D7TnBAZ5qhbxV:r+pe0lYixsfvDBAzK9V
Behavioral task
behavioral1
Sample
232645072140c854824be5e2e6eacfb5_JaffaCakes118.exe
Resource
win7-20240611-en
Malware Config
Extracted
cybergate
v1.11.0 - Public Version
L0rdfp
127.0.0.1:81
cyberg4t3.no-ip.biz :81
CDKE726M73ATM7
-
enable_keylogger
true
-
enable_message_box
true
-
ftp_directory
./logs
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
install
-
install_file
firefoxx.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
L0rdfp
-
message_box_title
CyberGate
-
password
02384545209
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Targets
-
-
Target
232645072140c854824be5e2e6eacfb5_JaffaCakes118
-
Size
281KB
-
MD5
232645072140c854824be5e2e6eacfb5
-
SHA1
7ec271db1889aac517f08b804c8f9556de4be1a1
-
SHA256
7051ee514c09d86ae0392cd7530066c1b82e740c7635dd7ef1a17de73de7513f
-
SHA512
14cf74ffff7e084c4551be6b3384c7eeb8f564120dcfd54fed865fad7666240c1007bec14d07793a1fbca6a720720a042ee009a4db3aab58f6402421c6813b84
-
SSDEEP
6144:uy+phcTwlTLfkixFUQKf3D7TnBAZ5qhbxV:r+pe0lYixsfvDBAzK9V
-
Adds policy Run key to start application
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Drops startup file
-
Adds Run key to start application
-
Drops file in System32 directory
-