Overview

overview

10

Static

static

3

d4f117fea4...18.exe

windows7-x64

10

d4f117fea4...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d4f117fea46e1272d0ef4f2c3e1def36_JaffaCakes118

  • Size

    304KB

  • Sample

    241208-djxzgsyqew

  • MD5

    d4f117fea46e1272d0ef4f2c3e1def36

  • SHA1

    e6ec1bbe61e6ab0e78c667d79c9ac8170f2a9c43

  • SHA256

    640583135645081a545ea956de6e20681073f84d11dfd38bc0910daff72e83ef

  • SHA512

    60680fe6a76dd5e6fb3ff5de64b32de5ed98bf6b15aed725660db778f0507d1dc5585bc855d8eb30a271297ee50bb08ea236b18e5106041179226dff9a4d61db

  • SSDEEP

    6144:LOhqzXoix0czN3XbFdo9CG+WubOdvxBJAjA7NT6R5GffJInCVnbpt:L+qb0e3XLg+3bOdv3JA8T6qSsbP

Score
10/10
cybergatebrkydiscoverypersistencestealertrojanupx

Malware Config

Extracted

Family

cybergate

Version

v1.02.1

Botnet

brky

C2

th3lekhe.no-ip.biz:60

Mutex

Pluguin

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    Micropsoft

  • install_file

    Pluguin.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    VOCÊ FOI HACKEADO ...SEU SISTEMA SERÁ FORMATADO.

  • message_box_title

    LAMMER

  • password

    1111

  • regkey_hkcu

    Avirnt

  • regkey_hklm

    Avgnt

Targets

    • Target

      d4f117fea46e1272d0ef4f2c3e1def36_JaffaCakes118

    • Size

      304KB

    • MD5

      d4f117fea46e1272d0ef4f2c3e1def36

    • SHA1

      e6ec1bbe61e6ab0e78c667d79c9ac8170f2a9c43

    • SHA256

      640583135645081a545ea956de6e20681073f84d11dfd38bc0910daff72e83ef

    • SHA512

      60680fe6a76dd5e6fb3ff5de64b32de5ed98bf6b15aed725660db778f0507d1dc5585bc855d8eb30a271297ee50bb08ea236b18e5106041179226dff9a4d61db

    • SSDEEP

      6144:LOhqzXoix0czN3XbFdo9CG+WubOdvxBJAjA7NT6R5GffJInCVnbpt:L+qb0e3XLg+3bOdv3JA8T6qSsbP

    Score
    10/10
    cybergatebrkydiscoverypersistencestealertrojanupx

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

      trojanstealercybergate

    • Cybergate family

      cybergate

    • Adds policy Run key to start application

      persistence

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks