Overview

overview

10

Static

static

10

57d464a905...18.exe

windows7-x64

10

57d464a905...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    57d464a90529a6af5dcda8721c312d49_JaffaCakes118

  • Size

    523KB

  • Sample

    241018-rbgt7ashqm

  • MD5

    57d464a90529a6af5dcda8721c312d49

  • SHA1

    05469d4c2b1d290894efa57f177cac2995d553d5

  • SHA256

    063665d2c56067b86eaacaa3fbaad678c824170b32e26831a3c9e99dadb251ce

  • SHA512

    573f0defb8e7a841ba0d152907903278e08d257f1a8f1b3348bf69c3825c85e5198bf0d104f307e8c09c04bc630017e2727484b146e8ba69fa9f58c03514a5bd

  • SSDEEP

    12288:bt1uQdGi1gaD68Dx2USVVffru+SaHU0WmrvM1:R1jdGi1gaD2USfbuwU0Wmy

Score
10/10
cybergatevítimadiscoverypersistencestealertrojanupx

Malware Config

Extracted

Family

cybergate

Version

2.5

Botnet

vítima

C2

127.0.0.1:81

adircool.no-ip.biz:8080

adircool.no-ip.biz:80

adircool.no-ip.biz:8081
Mutex

Microsoft_JDH887ND

Attributes
  • enable_keylogger

    true

  • enable_message_box

    true

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    spynet

  • install_file

    Microsoft_JDH887ND

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    ERROR. COULD NOT RUN THE EXECUTABLE.

  • message_box_title

    ERROR

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Targets

    • Target

      57d464a90529a6af5dcda8721c312d49_JaffaCakes118

    • Size

      523KB

    • MD5

      57d464a90529a6af5dcda8721c312d49

    • SHA1

      05469d4c2b1d290894efa57f177cac2995d553d5

    • SHA256

      063665d2c56067b86eaacaa3fbaad678c824170b32e26831a3c9e99dadb251ce

    • SHA512

      573f0defb8e7a841ba0d152907903278e08d257f1a8f1b3348bf69c3825c85e5198bf0d104f307e8c09c04bc630017e2727484b146e8ba69fa9f58c03514a5bd

    • SSDEEP

      12288:bt1uQdGi1gaD68Dx2USVVffru+SaHU0WmrvM1:R1jdGi1gaD2USfbuwU0Wmy

    Score
    10/10
    cybergatevítimadiscoverypersistencestealertrojanupx

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

      trojanstealercybergate

    • Adds policy Run key to start application

      persistence

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks