General

  • Target

    ccee4af16376dfd1fbae0f422e982c3a_JaffaCakes118

  • Size

    324KB

  • Sample

    240831-rapteaxbmq

  • MD5

    ccee4af16376dfd1fbae0f422e982c3a

  • SHA1

    32725d0610612c2782c84755ea3057ef3f621c08

  • SHA256

    5f31f2824fe304f40be12dfdab2fd88ea0e2cc8f42acd04718c6e6ab71685528

  • SHA512

    c9bdd5a79281f44e0241d246351589eb14b25a826fcef76e844a025c321daf476f15c18aedecb4dfead02a23f7301cef3db865e33b98f044b7928ab01fc12542

  • SSDEEP

    6144:DMWyyfm9PvqQHAdjJzv8ksMSezA8ge/v5EkyOixrGSgjOb9K:QWb6qeUjJzxfgyyncR

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

remote

C2

pakiganguff.zapto.org:100

Mutex

EE0L7I5EF244U3

Attributes
  • enable_keylogger

    true

  • enable_message_box

    true

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Programme Is not running correctely

  • message_box_title

    CyberGate

  • password

    123456

Targets

    • Target

      ccee4af16376dfd1fbae0f422e982c3a_JaffaCakes118

    • Size

      324KB

    • MD5

      ccee4af16376dfd1fbae0f422e982c3a

    • SHA1

      32725d0610612c2782c84755ea3057ef3f621c08

    • SHA256

      5f31f2824fe304f40be12dfdab2fd88ea0e2cc8f42acd04718c6e6ab71685528

    • SHA512

      c9bdd5a79281f44e0241d246351589eb14b25a826fcef76e844a025c321daf476f15c18aedecb4dfead02a23f7301cef3db865e33b98f044b7928ab01fc12542

    • SSDEEP

      6144:DMWyyfm9PvqQHAdjJzv8ksMSezA8ge/v5EkyOixrGSgjOb9K:QWb6qeUjJzxfgyyncR

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    • Adds policy Run key to start application

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks