Overview

overview

10

Static

static

10

3edb79c0e4...18.exe

windows7-x64

10

3edb79c0e4...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3edb79c0e40cdd96f06c9a15d0834c3e_JaffaCakes118

  • Size

    281KB

  • Sample

    240712-zsf8zsscqg

  • MD5

    3edb79c0e40cdd96f06c9a15d0834c3e

  • SHA1

    ecb3b1f7032f2009920b75c925ab21b6b3170ab0

  • SHA256

    af6f8eebcf46e60d76999fe32be639db503bd9f23f00dea6ba52363d9ca71118

  • SHA512

    f46fa44fd84dbc3a3649003e5286f43bdbee66e2a54c7635a455a483329cacf62b1632f88ff21e5481481aac5b28900be6937a961e4b6a470cd886f020e7394d

  • SSDEEP

    6144:HScrLF4mp8D6WGc/YSlIipBReubLzeh7Yy0DMIdeXijk:yciy78QSVnNyhsFMCeSjk

Score
10/10
cybergateandrax03-16-12persistencestealertrojanupx

Malware Config

Extracted

Family

cybergate

Version

v1.18.0 - Trial version

Botnet

Andrax03-16-12

C2

gp1990.no-ip.org:1990

Mutex

Q00W3PR166L34H

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    Winzip

  • install_file

    Windll.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    gp161990

  • regkey_hkcu

    Windll

  • regkey_hklm

    Windll

Targets

    • Target

      3edb79c0e40cdd96f06c9a15d0834c3e_JaffaCakes118

    • Size

      281KB

    • MD5

      3edb79c0e40cdd96f06c9a15d0834c3e

    • SHA1

      ecb3b1f7032f2009920b75c925ab21b6b3170ab0

    • SHA256

      af6f8eebcf46e60d76999fe32be639db503bd9f23f00dea6ba52363d9ca71118

    • SHA512

      f46fa44fd84dbc3a3649003e5286f43bdbee66e2a54c7635a455a483329cacf62b1632f88ff21e5481481aac5b28900be6937a961e4b6a470cd886f020e7394d

    • SSDEEP

      6144:HScrLF4mp8D6WGc/YSlIipBReubLzeh7Yy0DMIdeXijk:yciy78QSVnNyhsFMCeSjk

    Score
    10/10
    cybergateandrax03-16-12persistencestealertrojanupx

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

      trojanstealercybergate

    • Adds policy Run key to start application

      persistence

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks