Overview

overview

10

Static

static

10

8437bbc3b7...18.exe

windows7-x64

10

8437bbc3b7...18.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8437bbc3b736ae454adbc745af3d46b4_JaffaCakes118

  • Size

    324KB

  • Sample

    240810-a964assard

  • MD5

    8437bbc3b736ae454adbc745af3d46b4

  • SHA1

    632e0009d9f2300a39a654807accdafa12ae0dfe

  • SHA256

    20fb5e2d15969c82ced084bde28f5eb34e41b4ddd56447a0b1dee01b0dc9f7e9

  • SHA512

    fecfad8c35df9efd76c4d5e5f28caccaa55d75aab301d43fd26cf5c9bf95a1d6148c36b8b88cac97384d85d0f5e63d8489c5aa848afad4948864c44413f9a542

  • SSDEEP

    6144:ImcD66RRjI5JGm9pQsK3RDGu270juptJsCxC:BcD663bZGzk0aCx

Score
10/10
cybergatedefense_evasiondiscoverypersistencestealertrojanupx

Malware Config

Targets

    • Target

      8437bbc3b736ae454adbc745af3d46b4_JaffaCakes118

    • Size

      324KB

    • MD5

      8437bbc3b736ae454adbc745af3d46b4

    • SHA1

      632e0009d9f2300a39a654807accdafa12ae0dfe

    • SHA256

      20fb5e2d15969c82ced084bde28f5eb34e41b4ddd56447a0b1dee01b0dc9f7e9

    • SHA512

      fecfad8c35df9efd76c4d5e5f28caccaa55d75aab301d43fd26cf5c9bf95a1d6148c36b8b88cac97384d85d0f5e63d8489c5aa848afad4948864c44413f9a542

    • SSDEEP

      6144:ImcD66RRjI5JGm9pQsK3RDGu270juptJsCxC:BcD663bZGzk0aCx

    Score
    10/10
    cybergatediscoverypersistencestealertrojanupxdefense_evasion

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

      trojanstealercybergate

    • Adds policy Run key to start application

      persistence

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks