Overview

overview

10

Static

static

3

310da305c0...18.exe

windows7-x64

10

310da305c0...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    310da305c0e2639afd06e19125fb6022_JaffaCakes118

  • Size

    820KB

  • Sample

    240709-tksn6a1hql

  • MD5

    310da305c0e2639afd06e19125fb6022

  • SHA1

    8903ae5f99f0d678883bfc295f7535a913d121a3

  • SHA256

    d3edf0b54e394a6e0e2a37b91986e6aed4c3710a591cd164f45f82f3c77411bb

  • SHA512

    52b24ce5b8ae0fcde8ec6520e6af6b39b60e4021e1c98420763adac90f7bd6247bc06701fc883a0e3284a1c766ac3d8643f97e9fa6e5a76b1cfbce0267e9920e

  • SSDEEP

    12288:A4lkzS1d5OpV6byW7mj4zamlhB3T3V9UP5m1ro1fDkQflsekMe/wRY8fiMrBerzV:11X5ZJr2Wo6QiMpQYmxd

Score
10/10
cybergatepersistencestealertrojanupx

Malware Config

Targets

    • Target

      310da305c0e2639afd06e19125fb6022_JaffaCakes118

    • Size

      820KB

    • MD5

      310da305c0e2639afd06e19125fb6022

    • SHA1

      8903ae5f99f0d678883bfc295f7535a913d121a3

    • SHA256

      d3edf0b54e394a6e0e2a37b91986e6aed4c3710a591cd164f45f82f3c77411bb

    • SHA512

      52b24ce5b8ae0fcde8ec6520e6af6b39b60e4021e1c98420763adac90f7bd6247bc06701fc883a0e3284a1c766ac3d8643f97e9fa6e5a76b1cfbce0267e9920e

    • SSDEEP

      12288:A4lkzS1d5OpV6byW7mj4zamlhB3T3V9UP5m1ro1fDkQflsekMe/wRY8fiMrBerzV:11X5ZJr2Wo6QiMpQYmxd

    Score
    10/10
    cybergatepersistencestealertrojanupx

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

      trojanstealercybergate

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Adds policy Run key to start application

      persistence

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks