Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
476606f49781d7e7dfa651b74e9188d4_JaffaCakes118
-
Size
296KB
-
Sample
240715-aj3yysygkl
-
MD5
476606f49781d7e7dfa651b74e9188d4
-
SHA1
d9f5d92eef36cef94f984b4a11e1008666a133fd
-
SHA256
1ca2cb985fdbb423574595d5fd97ec2ca643c313eae7af05eec8f2eb103dfd47
-
SHA512
c1ae81d5ca9736f4e5ef7dbc2432a01bda6168625db926c574289e80cd0669b654adc5f30db4fa13dc4cc6377a2d2b1a92d5facb7c883ec1619229e172c8166e
-
SSDEEP
6144:/OpslFlq+hdBCkWYxuukP1pjSKSNVkq/MVJbf:/wsl/TBd47GLRMTbf
Behavioral task
behavioral1
Sample
476606f49781d7e7dfa651b74e9188d4_JaffaCakes118.exe
Resource
win7-20240708-en
Malware Config
Extracted
cybergate
v1.07.5
remote
fuckmexicans.no-ip.org:5000
73N7P17K4CO723
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
install
-
install_file
svchost.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
12345
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Targets
-
-
Target
476606f49781d7e7dfa651b74e9188d4_JaffaCakes118
-
Size
296KB
-
MD5
476606f49781d7e7dfa651b74e9188d4
-
SHA1
d9f5d92eef36cef94f984b4a11e1008666a133fd
-
SHA256
1ca2cb985fdbb423574595d5fd97ec2ca643c313eae7af05eec8f2eb103dfd47
-
SHA512
c1ae81d5ca9736f4e5ef7dbc2432a01bda6168625db926c574289e80cd0669b654adc5f30db4fa13dc4cc6377a2d2b1a92d5facb7c883ec1619229e172c8166e
-
SSDEEP
6144:/OpslFlq+hdBCkWYxuukP1pjSKSNVkq/MVJbf:/wsl/TBd47GLRMTbf
-
Adds policy Run key to start application
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-