Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    383aeed2e83a9dd3d763d49f264e8586_JaffaCakes118

  • Size

    353KB

  • Sample

    240711-jd5d9swbrq

  • MD5

    383aeed2e83a9dd3d763d49f264e8586

  • SHA1

    ea939564943e4cd1596871aaaba6e19f8655c54d

  • SHA256

    c067afb7d8acc54803d8b95d4f248afd69a5a4b97031f3a8894bdd34188710b8

  • SHA512

    43fe2e87db59339a87ca26fbe1afeb2eb94659009733f74bf51ae9760e2f09ee5fe0c8fa63fd9c55a09f52bdf65517d349fcb958a70da961afea944f793ad7d5

  • SSDEEP

    6144:CgqZlrSBVNenXrl4s30fkAzoydo263nvAlYRsBEZTfmStIZ8xQYl:KlfxL08A3o26YORKE95IZQQ

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

Cyber

C2

bc4l.No-ip.biz:100

Mutex

1P23V20HIP64ND

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    SearchIndexer.exe

  • install_dir

    System32

  • install_file

    SearchIndexer.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    123456

  • regkey_hkcu

    SearchIndexer.exe

  • regkey_hklm

    SearchIndexer.exe

Targets

    • Target

      383aeed2e83a9dd3d763d49f264e8586_JaffaCakes118

    • Size

      353KB

    • MD5

      383aeed2e83a9dd3d763d49f264e8586

    • SHA1

      ea939564943e4cd1596871aaaba6e19f8655c54d

    • SHA256

      c067afb7d8acc54803d8b95d4f248afd69a5a4b97031f3a8894bdd34188710b8

    • SHA512

      43fe2e87db59339a87ca26fbe1afeb2eb94659009733f74bf51ae9760e2f09ee5fe0c8fa63fd9c55a09f52bdf65517d349fcb958a70da961afea944f793ad7d5

    • SSDEEP

      6144:CgqZlrSBVNenXrl4s30fkAzoydo263nvAlYRsBEZTfmStIZ8xQYl:KlfxL08A3o26YORKE95IZQQ

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    • Adds policy Run key to start application

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.