General

  • Target

    c994e4f30fda4dc0a12dee53ae9edabe_JaffaCakes118

  • Size

    775KB

  • MD5

    c994e4f30fda4dc0a12dee53ae9edabe

  • SHA1

    8d2fe3dcaed2cd4d0779779c3750e9492380923d

  • SHA256

    20eee178b3ee2e66e0ac7104afc7035e7e59989c5da3ca68ac1e770ecbc243d5

  • SHA512

    4bfdc02acd743aa488e78e080abae5116c5cda10f2c77b0a204d378f85dd37d95e9dc95fa586fbe48168eec87ae7a8c4d03d624d256eeb9d40cacdfafbf6f0fa

  • SSDEEP

    12288:YcD66592zkPaCxFyT8tTocTWiBliBu0jrTk4yU+Y2:Y+9Okl+qLQE4MY2

Score
10/10

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

vítima

C2

127.0.0.1:81

filipeandreia.no-ip.org:81

Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • Cybergate family
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • c994e4f30fda4dc0a12dee53ae9edabe_JaffaCakes118
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections