Overview

overview

10

Static

static

3

99b2445df8...18.exe

windows7-x64

10

99b2445df8...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    99b2445df83796dc561cd0eb53baf58f_JaffaCakes118

  • Size

    300KB

  • Sample

    241125-gynk5synaq

  • MD5

    99b2445df83796dc561cd0eb53baf58f

  • SHA1

    565adfcd1307be41a6822dd56bb0bc7d361640bb

  • SHA256

    61a766f184b183ed47e194b327dad3973dcbb46899762f1cc5ecd72b0a95a8cc

  • SHA512

    1a2d0c033e977538a790c090bd9a2439baa25ca992590b0b4b58bf16004187466c0cc4d4a33bcf4a07494f2f7003cf9ca8af5d98f2cfa5e95589ebbd3b63892a

  • SSDEEP

    6144:rq6njPlaDz3my8WbNcjo2FP+C49UyGYZgRn0BBaKgEnB2/XTBZ:rfbADzWrmILV+myGsgRn0BBaKgEnB2/L

Score
10/10
cybergatevítimadiscoveryspywarestealertrojanupx

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

vítima

C2

botnabe.zapto.org:8181

Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    true

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    svchost.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Windos Xp stop

  • message_box_title

    Windos Xp stop

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Targets

    • Target

      99b2445df83796dc561cd0eb53baf58f_JaffaCakes118

    • Size

      300KB

    • MD5

      99b2445df83796dc561cd0eb53baf58f

    • SHA1

      565adfcd1307be41a6822dd56bb0bc7d361640bb

    • SHA256

      61a766f184b183ed47e194b327dad3973dcbb46899762f1cc5ecd72b0a95a8cc

    • SHA512

      1a2d0c033e977538a790c090bd9a2439baa25ca992590b0b4b58bf16004187466c0cc4d4a33bcf4a07494f2f7003cf9ca8af5d98f2cfa5e95589ebbd3b63892a

    • SSDEEP

      6144:rq6njPlaDz3my8WbNcjo2FP+C49UyGYZgRn0BBaKgEnB2/XTBZ:rfbADzWrmILV+myGsgRn0BBaKgEnB2/L

    Score
    10/10
    cybergatevítimadiscoveryspywarestealertrojanupx

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

      trojanstealercybergate

    • Cybergate family

      cybergate

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks