Overview

overview

10

Static

static

10

bcda6fc508...18.exe

windows7-x64

10

bcda6fc508...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bcda6fc508e663fdc1655abde968cad7_JaffaCakes118

  • Size

    1.7MB

  • Sample

    241203-ly8crswjfn

  • MD5

    bcda6fc508e663fdc1655abde968cad7

  • SHA1

    b86f10d152c2a36502346165dfe73103be0f19fe

  • SHA256

    dfdde5c151401d2bbb454d68f224c0fef8b7bd1ade5fe655082c8cae4de8c381

  • SHA512

    22ddba0ef958886efc040ea9ba00611a331a23d448ed1c503fb40ec6d3ae687fc5b65e6556f083095fb8de1e8f2096c8660f07777124158b0d5287f5de01b16b

  • SSDEEP

    49152:rqn7VxWWhzSenZncQLVxft5DEuQ7zWYNc2Oo:Y7thzSenZBZxnDy+KZOo

Score
10/10
cybergatevítimadiscoverypersistencestealertrojanupx

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

vítima

C2

jtehack.sytes.net:7643

Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    java.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    Java

  • regkey_hklm

    FIREWALL

Targets

    • Target

      bcda6fc508e663fdc1655abde968cad7_JaffaCakes118

    • Size

      1.7MB

    • MD5

      bcda6fc508e663fdc1655abde968cad7

    • SHA1

      b86f10d152c2a36502346165dfe73103be0f19fe

    • SHA256

      dfdde5c151401d2bbb454d68f224c0fef8b7bd1ade5fe655082c8cae4de8c381

    • SHA512

      22ddba0ef958886efc040ea9ba00611a331a23d448ed1c503fb40ec6d3ae687fc5b65e6556f083095fb8de1e8f2096c8660f07777124158b0d5287f5de01b16b

    • SSDEEP

      49152:rqn7VxWWhzSenZncQLVxft5DEuQ7zWYNc2Oo:Y7thzSenZBZxnDy+KZOo

    Score
    10/10
    cybergatevítimadiscoverypersistencestealertrojanupx

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

      trojanstealercybergate

    • Cybergate family

      cybergate

    • Adds policy Run key to start application

      persistence

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks