Overview

overview

10

Static

static

3

dafd691464...18.exe

windows7-x64

10

dafd691464...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dafd691464b16000b274d23ef7ad6023_JaffaCakes118

  • Size

    420KB

  • Sample

    241209-xae7vssjdn

  • MD5

    dafd691464b16000b274d23ef7ad6023

  • SHA1

    354ae9077928531efc9ad43d8c6b238fa0d9804c

  • SHA256

    de93391586b49bc102a6e12e9556f3ae1994964fc4b394d28ee4591c483e9304

  • SHA512

    6f4846c4130b292be515725d40c3c1affc72b2ebef89265d3f6f6d47c176d0dd69aaa7eb00ea12bb9e64eeafce2751c74d1448a5da57c53a6287fb9248b83d5c

  • SSDEEP

    12288:TsYTDg2LZ0fNa+iO7eISOlJhKfG9G+cBLg:TsYTDdLZGa+iO7e1yJUfGlcq

Score
10/10
cybergateöííédiscoverystealertrojan

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

ÖÍíÉ

C2

xhak.no-ip.org:288

Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    svchost.exe

  • install_file

    windows.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    t?tulo da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Targets

    • Target

      dafd691464b16000b274d23ef7ad6023_JaffaCakes118

    • Size

      420KB

    • MD5

      dafd691464b16000b274d23ef7ad6023

    • SHA1

      354ae9077928531efc9ad43d8c6b238fa0d9804c

    • SHA256

      de93391586b49bc102a6e12e9556f3ae1994964fc4b394d28ee4591c483e9304

    • SHA512

      6f4846c4130b292be515725d40c3c1affc72b2ebef89265d3f6f6d47c176d0dd69aaa7eb00ea12bb9e64eeafce2751c74d1448a5da57c53a6287fb9248b83d5c

    • SSDEEP

      12288:TsYTDg2LZ0fNa+iO7eISOlJhKfG9G+cBLg:TsYTDdLZGa+iO7e1yJUfGlcq

    Score
    10/10
    cybergateöííédiscoverystealertrojan

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

      trojanstealercybergate

    • Cybergate family

      cybergate

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks