General

  • Target

    e359d3a28b7550c71fa57704deead075_JaffaCakes118

  • Size

    484KB

  • Sample

    240915-zt42fashnn

  • MD5

    e359d3a28b7550c71fa57704deead075

  • SHA1

    d57b089294e22c20b0b21cd41ef7caa612856fbe

  • SHA256

    aeb0cfb585b767f693b23697acbc5da4338c45f06f8a8fe0c58ea707d59ed461

  • SHA512

    a4ca62c0b7b5a95d3070f65ce1ee112b4d609e355d5212617282168ad5716ef4a68e6b1f6056653f05dad87280aab41cd64bac9d8c36eb6cc909737198e1e8b4

  • SSDEEP

    12288:U3yG42ql+8h03I6I4u5sBFJCTbiX3ukkkkkkkkk:Ui9wH3k4A2bCTe

Malware Config

Extracted

Family

cybergate

Version

v1.04.8

Botnet

remote

C2

superman2.serveftp.com:82

Mutex

1863FLX6N45B7T

Attributes
  • enable_keylogger

    true

  • enable_message_box

    true

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    false

  • keylogger_enable_ftp

    false

  • message_box_caption

    No internet connection.

  • message_box_title

    Error !

  • password

    aaa

Targets

    • Target

      e359d3a28b7550c71fa57704deead075_JaffaCakes118

    • Size

      484KB

    • MD5

      e359d3a28b7550c71fa57704deead075

    • SHA1

      d57b089294e22c20b0b21cd41ef7caa612856fbe

    • SHA256

      aeb0cfb585b767f693b23697acbc5da4338c45f06f8a8fe0c58ea707d59ed461

    • SHA512

      a4ca62c0b7b5a95d3070f65ce1ee112b4d609e355d5212617282168ad5716ef4a68e6b1f6056653f05dad87280aab41cd64bac9d8c36eb6cc909737198e1e8b4

    • SSDEEP

      12288:U3yG42ql+8h03I6I4u5sBFJCTbiX3ukkkkkkkkk:Ui9wH3k4A2bCTe

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks