General
-
Target
93d545ac6042ba5a9c5df4d2340ff747_JaffaCakes118
-
Size
302KB
-
Sample
240813-tst7ysydkk
-
MD5
93d545ac6042ba5a9c5df4d2340ff747
-
SHA1
0a7f283d0189360889a27a64b88281069249ffbd
-
SHA256
87721019005839a7594986e1d40dbf88ad213439e2572518806b5193e2c0bc5a
-
SHA512
7f7c3b98261afd3e419f14f05518254ff4c25a2fe1c99c02676e273bc43f243b0c6a8647e2e6d895c80172351de4c6fabe693c5146f9c4538673a77d9ed2e475
-
SSDEEP
6144:ocVife4PlVifpenEVshiYWKW1LRnt4PEAPHOGfX5kHYvCP06O3Wcy/T/3nK23Js9:xVife4PlVifpenEVshiYWKW1LRnt4PEi
Static task
static1
Behavioral task
behavioral1
Sample
93d545ac6042ba5a9c5df4d2340ff747_JaffaCakes118.exe
Resource
win7-20240704-en
Malware Config
Extracted
cybergate
2.5
vítima
mierda.no-ip.org:8080
asdd.zapto.org:8080
dasdasdas.zapto.org:8080
***MUTEX***
-
enable_keylogger
true
-
enable_message_box
true
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
sis
-
install_file
sis34.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Se he producido un error critico en el programa, pruebe a reiniciarlo en modo de compatibilidad
-
message_box_title
Codigo de error 4xCg7f
-
password
1234
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Targets
-
-
Target
93d545ac6042ba5a9c5df4d2340ff747_JaffaCakes118
-
Size
302KB
-
MD5
93d545ac6042ba5a9c5df4d2340ff747
-
SHA1
0a7f283d0189360889a27a64b88281069249ffbd
-
SHA256
87721019005839a7594986e1d40dbf88ad213439e2572518806b5193e2c0bc5a
-
SHA512
7f7c3b98261afd3e419f14f05518254ff4c25a2fe1c99c02676e273bc43f243b0c6a8647e2e6d895c80172351de4c6fabe693c5146f9c4538673a77d9ed2e475
-
SSDEEP
6144:ocVife4PlVifpenEVshiYWKW1LRnt4PEAPHOGfX5kHYvCP06O3Wcy/T/3nK23Js9:xVife4PlVifpenEVshiYWKW1LRnt4PEi
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-