Behavioral task
behavioral1
Sample
90fdbae3cf022acdd0a4f8e4ddd0c4ce_JaffaCakes118.exe
Resource
win7-20240729-en
General
-
Target
90fdbae3cf022acdd0a4f8e4ddd0c4ce_JaffaCakes118
-
Size
399KB
-
MD5
90fdbae3cf022acdd0a4f8e4ddd0c4ce
-
SHA1
6dd785bfcbe9f3e7f7f889283922e6b1a9af500c
-
SHA256
01c453ee2300c08ce4a0966afd4dbfa6945b983b71a0d1e7f1c48d89c467b897
-
SHA512
79084278aa23896164aaa5ceb8d1a686a79d75e45beb5117a1d2b60574af352c29146001f8d6e256174a88de8afbd16482b34161f0a93e0df42b0f9f19defe15
-
SSDEEP
6144:m3GGFsxZZQttyCVxaWYSdMU/77hlruc6XmDoTbcI7CPPdKIdjqIQ9i:SGceAtpVxagMU/plruchDofAPj+j
Malware Config
Extracted
cybergate
v1.02.0
Cyber
j6u.no-ip.info:3074
6UX4U81725V52X
-
enable_keylogger
true
-
enable_message_box
true
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
lsass.exe
-
install_dir
Microsoft
-
install_file
explorer.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
JeZuS Booter has problems starting up. Please try again.
-
message_box_title
Windows Internet Explorer
-
password
123456
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
Files
-
90fdbae3cf022acdd0a4f8e4ddd0c4ce_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
UPX0 Size: 104KB - Virtual size: 104KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 267KB - Virtual size: 268KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 27KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE