General
-
Target
c6e04a31bb219ec8dfe9034e1357a8b1_JaffaCakes118
-
Size
700KB
-
Sample
241205-kp4gsasrar
-
MD5
c6e04a31bb219ec8dfe9034e1357a8b1
-
SHA1
790e2c90613adc04e4dd267cb7ce4577908b02cb
-
SHA256
334503851aac0f70a02ab60a0bf25f62bb2d5c6bc1d0a5f06df345783e3f3480
-
SHA512
e674d1c5201a01f770afd2514d0048e18c5eb56d8fefb598ec5fa063660c8302c833aaa2cafafd5934d49b1e26db6786c0704b5a1c1c00d1cbbec3eca53f9ba1
-
SSDEEP
12288:A5klbzD74nKsmJrb3qbeqRHfCLo2WjSRNHOt2wkMkHknk8hJ9G0zY:AyYbfB
Static task
static1
Behavioral task
behavioral1
Sample
c6e04a31bb219ec8dfe9034e1357a8b1_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
c6e04a31bb219ec8dfe9034e1357a8b1_JaffaCakes118.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
cybergate
v3.4.2.2
swing1110
videosonline.serveblog.net:24100
1537O11CH070VC
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
Updates
-
install_file
msnbc.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
rdxrMy5m
-
regkey_hkcu
dmw
Targets
-
-
Target
c6e04a31bb219ec8dfe9034e1357a8b1_JaffaCakes118
-
Size
700KB
-
MD5
c6e04a31bb219ec8dfe9034e1357a8b1
-
SHA1
790e2c90613adc04e4dd267cb7ce4577908b02cb
-
SHA256
334503851aac0f70a02ab60a0bf25f62bb2d5c6bc1d0a5f06df345783e3f3480
-
SHA512
e674d1c5201a01f770afd2514d0048e18c5eb56d8fefb598ec5fa063660c8302c833aaa2cafafd5934d49b1e26db6786c0704b5a1c1c00d1cbbec3eca53f9ba1
-
SSDEEP
12288:A5klbzD74nKsmJrb3qbeqRHfCLo2WjSRNHOt2wkMkHknk8hJ9G0zY:AyYbfB
-
Cybergate family
-
Adds policy Run key to start application
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2