General

  • Target

    24368c736d30f165d3dbc28c75e4ccfe_JaffaCakes118

  • Size

    1.2MB

  • Sample

    240704-b689xszcmb

  • MD5

    24368c736d30f165d3dbc28c75e4ccfe

  • SHA1

    01477fa0e191dc85a636cdf3cf9737019f6f9983

  • SHA256

    2d0d20813cd366796f94a524f90c760e08bb96126780da969a2b618e993b70a0

  • SHA512

    a341c4818f183b86a64247e9a554ef9867291f8ee2cf2fed89449c87bb5cbba8989405980ea32f208d0e9f6a9796aafbf1df000e95f6410add6c3e7312140182

  • SSDEEP

    24576:kwQjN2K3yWhs0JkKyVmDjMaeK4Mj6EnQ3v0lqKTVZfkGGI+rSjbQknKx2AdeLDq9:klYahsLoDJefMZQcqGf3Krtk1zVuxU6

Malware Config

Extracted

Family

cybergate

Version

2.7 Final

Botnet

o comercio

C2

hilt000.no-ip.org:888

Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    explorer.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    123

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Targets

    • Target

      24368c736d30f165d3dbc28c75e4ccfe_JaffaCakes118

    • Size

      1.2MB

    • MD5

      24368c736d30f165d3dbc28c75e4ccfe

    • SHA1

      01477fa0e191dc85a636cdf3cf9737019f6f9983

    • SHA256

      2d0d20813cd366796f94a524f90c760e08bb96126780da969a2b618e993b70a0

    • SHA512

      a341c4818f183b86a64247e9a554ef9867291f8ee2cf2fed89449c87bb5cbba8989405980ea32f208d0e9f6a9796aafbf1df000e95f6410add6c3e7312140182

    • SSDEEP

      24576:kwQjN2K3yWhs0JkKyVmDjMaeK4Mj6EnQ3v0lqKTVZfkGGI+rSjbQknKx2AdeLDq9:klYahsLoDJefMZQcqGf3Krtk1zVuxU6

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    • Adds policy Run key to start application

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks