Overview

overview

10

Static

static

3

a03220848f...18.exe

windows7-x64

10

a03220848f...18.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a03220848fcfc23256fda278c25e5a91_JaffaCakes118

  • Size

    353KB

  • Sample

    241126-gmjstatrem

  • MD5

    a03220848fcfc23256fda278c25e5a91

  • SHA1

    6fe467e91a30f94b51379a3e17a86905c70d7113

  • SHA256

    cb4fdbb40465364f5cd5c29b65fb85fab311ffbcbd4d3d5ee287ebba937ef02e

  • SHA512

    5bc78a00edf57fcafcaef3fbce9c9949909e44c1a4a4d89a402443895f3ec0879e605b9207069096f1f4fce67d33056ea2acb0c690393a70354153951de01a11

  • SSDEEP

    6144:y5c7G22OxGaXeGFdQTfrJh4lk0WJEwxURFB3PUDSStAWZZZCfE4+:q/EO0WJf8tESTxfE4+

Score
10/10
cybergateyedekdiscoverypersistencestealertrojan

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

Yedek

C2

fezatoo.no-ip.org:3128

Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • ftp_password

    296gWAlfPS

  • ftp_port

    21

  • ftp_server

    ftp.boomobile.net

  • ftp_username

    boomobil

  • injected_process

    explorer.exe

  • install_file

    ctfmon.exe

  • install_flag

    true

  • keylogger_enable_ftp

    true

  • message_box_caption

    Deðilsen Sie Go :)

  • message_box_title

    Kulaklý Mýsýn ?

  • password

    feza857

  • regkey_hklm

    HKLM

Targets

    • Target

      a03220848fcfc23256fda278c25e5a91_JaffaCakes118

    • Size

      353KB

    • MD5

      a03220848fcfc23256fda278c25e5a91

    • SHA1

      6fe467e91a30f94b51379a3e17a86905c70d7113

    • SHA256

      cb4fdbb40465364f5cd5c29b65fb85fab311ffbcbd4d3d5ee287ebba937ef02e

    • SHA512

      5bc78a00edf57fcafcaef3fbce9c9949909e44c1a4a4d89a402443895f3ec0879e605b9207069096f1f4fce67d33056ea2acb0c690393a70354153951de01a11

    • SSDEEP

      6144:y5c7G22OxGaXeGFdQTfrJh4lk0WJEwxURFB3PUDSStAWZZZCfE4+:q/EO0WJf8tESTxfE4+

    Score
    10/10
    cybergateyedekdiscoverypersistencestealertrojan

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

      trojanstealercybergate

    • Cybergate family

      cybergate

    • Adds policy Run key to start application

      persistence

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks