General
-
Target
f04f5c550ab73d8c1d4472b04a9be779_JaffaCakes118
-
Size
345KB
-
MD5
f04f5c550ab73d8c1d4472b04a9be779
-
SHA1
860ef10c41d6a1b56f91f0bf9e3101f68e615522
-
SHA256
38a269c9ccbd442b4366348dfbfa48b0b4e15beacfab27c5ec8257ed714a7d18
-
SHA512
9e69b49b9478a9a5f61197670dbc0ce781c299bb18e6ace7ee7b86d167a9cc8210e16bf5fcb23fe9f1e2834a9ef0a51f20fed3db87e50cd06077191be6c085eb
-
SSDEEP
6144:AmcD66Rm5JGmrpQsK3RD2u270jupCJsCxCsIBhd8v:pcD66VZ2zkPaCx2h
Malware Config
Extracted
cybergate
2.6
vítima
darkcitow.sytes.net:80
darkcitow.sytes.net:82
darkcitow.sytes.net:81
***MUTEX***
-
enable_keylogger
true
-
enable_message_box
true
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
install
-
install_file
server.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Error al iniciar la aplicacon porque no se encontro sqlite.dll. La reinstalacion de la aplicacion puede solucionar el problema.
-
message_box_title
Generador Ugc.exe - No se puede encontrar el componente
-
password
abcd1234
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
Cybergate family
-
UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
f04f5c550ab73d8c1d4472b04a9be779_JaffaCakes118
Headers
Sections