Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

a8fad24ae4...18.exe

windows7-x64

10

a8fad24ae4...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a8fad24ae4ea7e2c5c611b629b3fae1f_JaffaCakes118

  • Size

    345KB

  • Sample

    240819-bjvg9awaqa

  • MD5

    a8fad24ae4ea7e2c5c611b629b3fae1f

  • SHA1

    4b7647ae1cbd7b52f19696d1ceaf5a783c9ca8b8

  • SHA256

    a7df3689580d30583946eb185452537368aaf23bf29868112e8272c5db262840

  • SHA512

    cafc43e601a9ed3f204ea9e78dda52cef0717224933399afa1cc2eb5829023149e6eefacf4920e5e190985d21b4d8a8e1d1d5003a93502e6361415a361cf1764

  • SSDEEP

    6144:jzTCQn87HtO4mRUam7Gdvwfj476hQnOqANWRq8VHu40UjgUK9bZxU:zCQ2+AGG7RhQnwgpJuXUjM9t

Score
10/10
cybergateöííédiscoverystealertrojan

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

ÖÍíÉ

C2

127.0.0.1:288

Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    svchost.exe

  • install_file

    windows.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    t?tulo da mensagem

  • password

    abcd1234

Targets

    • Target

      a8fad24ae4ea7e2c5c611b629b3fae1f_JaffaCakes118

    • Size

      345KB

    • MD5

      a8fad24ae4ea7e2c5c611b629b3fae1f

    • SHA1

      4b7647ae1cbd7b52f19696d1ceaf5a783c9ca8b8

    • SHA256

      a7df3689580d30583946eb185452537368aaf23bf29868112e8272c5db262840

    • SHA512

      cafc43e601a9ed3f204ea9e78dda52cef0717224933399afa1cc2eb5829023149e6eefacf4920e5e190985d21b4d8a8e1d1d5003a93502e6361415a361cf1764

    • SSDEEP

      6144:jzTCQn87HtO4mRUam7Gdvwfj476hQnOqANWRq8VHu40UjgUK9bZxU:zCQ2+AGG7RhQnwgpJuXUjM9t

    Score
    10/10
    cybergateöííédiscoverystealertrojan

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

      trojanstealercybergate

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks