Overview

overview

10

Static

static

10

f04f5c550a...18.exe

windows7-x64

10

f04f5c550a...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f04f5c550ab73d8c1d4472b04a9be779_JaffaCakes118

  • Size

    345KB

  • Sample

    240921-v62dvsvdrn

  • MD5

    f04f5c550ab73d8c1d4472b04a9be779

  • SHA1

    860ef10c41d6a1b56f91f0bf9e3101f68e615522

  • SHA256

    38a269c9ccbd442b4366348dfbfa48b0b4e15beacfab27c5ec8257ed714a7d18

  • SHA512

    9e69b49b9478a9a5f61197670dbc0ce781c299bb18e6ace7ee7b86d167a9cc8210e16bf5fcb23fe9f1e2834a9ef0a51f20fed3db87e50cd06077191be6c085eb

  • SSDEEP

    6144:AmcD66Rm5JGmrpQsK3RD2u270jupCJsCxCsIBhd8v:pcD66VZ2zkPaCx2h

Score
10/10
cybergatevítimadiscoverypersistencestealertrojanupx

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

vítima

C2

darkcitow.sytes.net:80

darkcitow.sytes.net:82

darkcitow.sytes.net:81
Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    true

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Error al iniciar la aplicacon porque no se encontro sqlite.dll. La reinstalacion de la aplicacion puede solucionar el problema.

  • message_box_title

    Generador Ugc.exe - No se puede encontrar el componente

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Targets

    • Target

      f04f5c550ab73d8c1d4472b04a9be779_JaffaCakes118

    • Size

      345KB

    • MD5

      f04f5c550ab73d8c1d4472b04a9be779

    • SHA1

      860ef10c41d6a1b56f91f0bf9e3101f68e615522

    • SHA256

      38a269c9ccbd442b4366348dfbfa48b0b4e15beacfab27c5ec8257ed714a7d18

    • SHA512

      9e69b49b9478a9a5f61197670dbc0ce781c299bb18e6ace7ee7b86d167a9cc8210e16bf5fcb23fe9f1e2834a9ef0a51f20fed3db87e50cd06077191be6c085eb

    • SSDEEP

      6144:AmcD66Rm5JGmrpQsK3RD2u270jupCJsCxCsIBhd8v:pcD66VZ2zkPaCx2h

    Score
    10/10
    cybergatevítimadiscoverypersistencestealertrojanupx

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

      trojanstealercybergate

    • Adds policy Run key to start application

      persistence

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks