General

  • Target

    936d6ef490397bcf14ee91079410da03_JaffaCakes118

  • Size

    273KB

  • Sample

    240813-rhrmzasfnq

  • MD5

    936d6ef490397bcf14ee91079410da03

  • SHA1

    2c5d885ce8459447dd3171e8686197c8ff63ac50

  • SHA256

    c5688180a56bc9d7d7fe4b42f4fabfd951089e916845818f41c22ffb682e7966

  • SHA512

    c30d93bc2d8bbd7bb241ce04e4f2452fdb000b05a285a5b489927f1bbe0abdb5505482661f7a50f5b11472a44dade8304260ff971622bd04cddeefd166b19f54

  • SSDEEP

    6144:lk4qmRurjowitAMpnOoxC/y2Q+W832n6nBL/URgeQQ:i9Zj7itNpF2yiL/UdQ

Malware Config

Extracted

Family

cybergate

Botnet

TRUE

C2

ÝØðÕÞÎÝÎÅý¼¼ûÙÈìÎÓßýØØÎÙÏϼ¼êÕÎÈÉÝÐìÎÓÈÙßȼ¼êÕÎÈÉÝÐýÐÐÓß¼¼êÕÎÈÉÝÐúÎÙÙ¼¼¼ùÄÕÈìÎÓßÙÏϼ¼¼ðÏÝÿÐÓÏÙ¼¼ÿÎÅÌÈéÒÌÎÓÈÙßÈøÝÈݼ¼ÿÓèÝÏ×ñÙÑúÎÙÙ¼¼¼ïÅÏúÎÙÙïÈÎÕÒÛ¼¼¼ìïÈÓÎÙÿÎÙÝÈÙõÒÏÈÝÒßÙ¼¼îÝÏùÒÉÑùÒÈÎÕÙÏý¼¼¼ïôûÙÈïÌÙßÕÝÐúÓÐØÙÎìÝÈÔý¼¼¼èÓýÏßÕÕ¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼}

FALSE

16

0

título da mensagem

texto da mensagem

TRUE

ftp.server.com

./logs/

ftp_user

ªš÷Öº+Þ

21

30

Mutex

Attributes
  • enable_keylogger

    false

  • enable_message_box

    true

  • install_dir

    TRUE

  • install_file

    TRUE

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    FALSE

  • message_box_title

    FALSE

  • password

    TRUE

  • regkey_hkcu

    TRUE

  • regkey_hklm

    TRUE

Extracted

Family

cybergate

Version

2.7 Beta 02

Botnet

vítima

C2

legolas8.no-ip.biz:288

Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

Targets

    • Target

      936d6ef490397bcf14ee91079410da03_JaffaCakes118

    • Size

      273KB

    • MD5

      936d6ef490397bcf14ee91079410da03

    • SHA1

      2c5d885ce8459447dd3171e8686197c8ff63ac50

    • SHA256

      c5688180a56bc9d7d7fe4b42f4fabfd951089e916845818f41c22ffb682e7966

    • SHA512

      c30d93bc2d8bbd7bb241ce04e4f2452fdb000b05a285a5b489927f1bbe0abdb5505482661f7a50f5b11472a44dade8304260ff971622bd04cddeefd166b19f54

    • SSDEEP

      6144:lk4qmRurjowitAMpnOoxC/y2Q+W832n6nBL/URgeQQ:i9Zj7itNpF2yiL/UdQ

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    • Adds policy Run key to start application

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks