Behavioral task
behavioral1
Sample
950ab51f1da7fe124afdd466efd75324_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
950ab51f1da7fe124afdd466efd75324_JaffaCakes118
-
Size
327KB
-
MD5
950ab51f1da7fe124afdd466efd75324
-
SHA1
d473be0d089c403b8e8eefa3d9bd351e288c4707
-
SHA256
3a3b875f79c1f23ccdd80d83811cc41c8be2895347343eb3ec8f822588b4a3d8
-
SHA512
469e93e981bdedde9d934e25e49c9ce3c84493840d6d04bad349ac9d48b9fa234c1e583cd67d8dffe2baee559097f37485be9156aadc243de6ce6a6b6d49e296
-
SSDEEP
6144:W3msxZZQttyCVxaWYSdMU/77hlruc6XmDoTbcI7CPPdOIKxHJJ:CmeAtpVxagMU/plruchDofAPMZ
Malware Config
Extracted
cybergate
v1.02.0
Cyber
slavenik.no-ip.biz:82
308XSV80UR1BPM
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
csrss.exe
-
install_dir
Microsoft
-
install_file
Windows Update.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
123456
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
Files
-
950ab51f1da7fe124afdd466efd75324_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
UPX0 Size: 64KB - Virtual size: 64KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 259KB - Virtual size: 260KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE