cybergate | 5a2a7f1bc89cf311837766d868487ae8_JaffaCakes118

General

Target
5a2a7f1bc89cf311837766d868487ae8_JaffaCakes118
Size 689KB
Sample240719-dbbfhssejc
SHA256 1889a92b238788e5002b6da79bef83fca7831e39177d0c3a9ec51489f8e0ce55
MD5 5a2a7f1bc89cf311837766d868487ae8
SHA1 16b299997effdfff307b189edb9d8f074bd4adec
SHA512 15f456943576543914c868e968362485cf2989ad1bdd8be0b8f83724da927083847132afc583ed6ce63eac698cc7a1a3990075d0f93f49761a479ce3de6f6cbb
SSDEEP 12288:CcD66kQ4dLOSwCDfJqlE6uGiGSAlVLuBRzXA2oAMHVB66EYAUTS9D/ksSzQRA:CjLtwCc26uGi2VCHXSBzTaDMsAQR
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

upx vítima cybergate

Malware Config

Extracted

Family

cybergate

Version

2.7 Final

Botnet

vítima

C2

127.0.0.1:81
sayhaaa.no-ip.org:81
sayhaaa.no-ip.org:82
sayhaaa.no-ip.org:83

Mutex

***MUTEX***

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
install
install_file
server.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
texto da mensagem
message_box_title
título da mensagem
password
abcd1234
regkey_hkcu
HKCU
regkey_hklm
HKLM

Signatures

Cybergate family
cybergate

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5a2a7f1bc89cf311837766d868487ae8_JaffaCakes118

File Explorer

5a2a7f1bc89cf311837766d868487ae8_JaffaCakes118

.exe 689KB

5a2a7f1bc89cf311837766d868487ae8_JaffaCakes118

SHA256 1889a92b238788e5002b6da79bef83fca7831e39177d0c3a9ec51489f8e0ce55
MD5 5a2a7f1bc89cf311837766d868487ae8
SHA1 16b299997effdfff307b189edb9d8f074bd4adec
SHA512 15f456943576543914c868e968362485cf2989ad1bdd8be0b8f83724da927083847132afc583ed6ce63eac698cc7a1a3990075d0f93f49761a479ce3de6f6cbb
SSDEEP 12288:CcD66kQ4dLOSwCDfJqlE6uGiGSAlVLuBRzXA2oAMHVB66EYAUTS9D/ksSzQRA:CjLtwCc26uGi2VCHXSBzTaDMsAQR
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

48116

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Sharing