Overview

overview

10

Static

static

7

d1fd307275...18.exe

windows7-x64

10

d1fd307275...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    d1fd3072750e20ed11615ebe4b60f091_JaffaCakes118

  • Size

    468KB

  • Sample

    240907-p8bnbsxeqg

  • MD5

    d1fd3072750e20ed11615ebe4b60f091

  • SHA1

    0c3f0460664e0430a28321fae990956e5b351556

  • SHA256

    2b2ec7d4d66fa9910af188d406b3f2055dfcefbaa92fd5a1d549d133c5825280

  • SHA512

    97f47add4c515d596e685e73f8d45316415512fa2aea202d7fe952391589785a92402503fab9026a36aa6a9b92f47c19ea3438e4195dc6a60d54c0ae86fe4b8c

  • SSDEEP

    6144:/EYZeajGUF4yU3N3U/PxNKlCJijkzMxnKyUnk8XlcKNIA5nvckqYKz7Kslee8ToJ:ZeajGW2CPxgn+zWsVxSeevCFq8S45q

Score
10/10
cybergatediscoverypersistencestealertrojanupx

Malware Config

Targets

    • Target

      d1fd3072750e20ed11615ebe4b60f091_JaffaCakes118

    • Size

      468KB

    • MD5

      d1fd3072750e20ed11615ebe4b60f091

    • SHA1

      0c3f0460664e0430a28321fae990956e5b351556

    • SHA256

      2b2ec7d4d66fa9910af188d406b3f2055dfcefbaa92fd5a1d549d133c5825280

    • SHA512

      97f47add4c515d596e685e73f8d45316415512fa2aea202d7fe952391589785a92402503fab9026a36aa6a9b92f47c19ea3438e4195dc6a60d54c0ae86fe4b8c

    • SSDEEP

      6144:/EYZeajGUF4yU3N3U/PxNKlCJijkzMxnKyUnk8XlcKNIA5nvckqYKz7Kslee8ToJ:ZeajGW2CPxgn+zWsVxSeevCFq8S45q

    Score
    10/10
    cybergatediscoverypersistencestealertrojanupx

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

      trojanstealercybergate

    • Adds policy Run key to start application

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Molebox Virtualization software

      Detects file using Molebox Virtualization software.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks