General
-
Target
d02ba354901489cf278ad56433ef7e28_JaffaCakes118
-
Size
320KB
-
Sample
241207-clgvlsznc1
-
MD5
d02ba354901489cf278ad56433ef7e28
-
SHA1
e2ec6732777563b39db60b176817d4da0c26aa35
-
SHA256
b6646bb41f8341736ebff99b04bfc9ee405707de6f780a1885de7c7f7a9e348e
-
SHA512
ebaa3eaeb07ba4a0cfe5fd69ee5b967e6400d5548f23a35964abb99926a99105eca91595fde50b07fc480c76107b13c8ef3f413c9be52c9a4d360a3031746703
-
SSDEEP
6144:NGMNaTYq6CrOg2mYgvDiyalpN7DGnt2yPj+i1yGPgfQrmBw5pXnaU1Eq:NOMq6CKgRYkDdaV7DS2CAGIQhlna8l
Static task
static1
Behavioral task
behavioral1
Sample
d02ba354901489cf278ad56433ef7e28_JaffaCakes118.exe
Resource
win7-20240903-en
Malware Config
Extracted
cybergate
v1.11.0 - Public Version
victim
ninjamonke123.zapto.org:1234
1M76RDC0L28Q06
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
Microsoft
-
install_file
server.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
password
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Extracted
latentbot
ninjamonke123.zapto.org
Targets
-
-
Target
d02ba354901489cf278ad56433ef7e28_JaffaCakes118
-
Size
320KB
-
MD5
d02ba354901489cf278ad56433ef7e28
-
SHA1
e2ec6732777563b39db60b176817d4da0c26aa35
-
SHA256
b6646bb41f8341736ebff99b04bfc9ee405707de6f780a1885de7c7f7a9e348e
-
SHA512
ebaa3eaeb07ba4a0cfe5fd69ee5b967e6400d5548f23a35964abb99926a99105eca91595fde50b07fc480c76107b13c8ef3f413c9be52c9a4d360a3031746703
-
SSDEEP
6144:NGMNaTYq6CrOg2mYgvDiyalpN7DGnt2yPj+i1yGPgfQrmBw5pXnaU1Eq:NOMq6CKgRYkDdaV7DS2CAGIQhlna8l
-
Cybergate family
-
Latentbot family
-
Adds policy Run key to start application
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Uses the VBS compiler for execution
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-