General
-
Target
d1a86e983cee85804b8cee8430185892_JaffaCakes118
-
Size
548KB
-
Sample
240907-lxeztsxhlk
-
MD5
d1a86e983cee85804b8cee8430185892
-
SHA1
356721df1da0ded57282fc48631f0835d654cc31
-
SHA256
b70b9b59db2924fb75118e0305a0b154a7d1b59c4ca5310300472c7ab0fd5412
-
SHA512
044512d2fe0f0c0b7fb5b2ff0e18bfa31e7baedf503bc764c54869a1c3b5728d6b8fd62ffd4d4b845c21fb55173c518fef3a15d29c35b1dfdcc2e0098d7a217b
-
SSDEEP
12288:f9IE+w75d73jRUJgNhwY3C2k9Yz3ueNA+DwWg/B:f9IE+KHjGJkwYy2kKz3ueKWg/B
Static task
static1
Behavioral task
behavioral1
Sample
d1a86e983cee85804b8cee8430185892_JaffaCakes118.exe
Resource
win7-20240708-en
Malware Config
Extracted
cybergate
v1.07.5
remote
127.0.0.1:999
127.0.0.1:81
2EO5FBQ787G3B2
-
enable_keylogger
true
-
enable_message_box
true
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
install
-
install_file
server.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world. Fack you!!!
-
message_box_title
CyberGate
-
password
guru
Targets
-
-
Target
d1a86e983cee85804b8cee8430185892_JaffaCakes118
-
Size
548KB
-
MD5
d1a86e983cee85804b8cee8430185892
-
SHA1
356721df1da0ded57282fc48631f0835d654cc31
-
SHA256
b70b9b59db2924fb75118e0305a0b154a7d1b59c4ca5310300472c7ab0fd5412
-
SHA512
044512d2fe0f0c0b7fb5b2ff0e18bfa31e7baedf503bc764c54869a1c3b5728d6b8fd62ffd4d4b845c21fb55173c518fef3a15d29c35b1dfdcc2e0098d7a217b
-
SSDEEP
12288:f9IE+w75d73jRUJgNhwY3C2k9Yz3ueNA+DwWg/B:f9IE+KHjGJkwYy2kKz3ueKWg/B
-
Executes dropped EXE
-
Loads dropped DLL
-
Uses the VBS compiler for execution
-
Suspicious use of SetThreadContext
-