General

  • Target

    e354b1f151c5f26041afce687f0d0a57_JaffaCakes118

  • Size

    936KB

  • Sample

    241211-1hpytatnbl

  • MD5

    e354b1f151c5f26041afce687f0d0a57

  • SHA1

    4fd0a27c25daa7d4b42110ffaf33f29781f8d3ce

  • SHA256

    099d8111410ae88b77a40a7c415b17d94c53ceb401b5437c35ac076e6cc123e4

  • SHA512

    7332bce808de986ebe926f9190c2157c34c82689c00a0217585c580e18b8c376df3aad76f95875705bc7a069e451e0b40633bd1dea541eea2e4783a5f5cb724e

  • SSDEEP

    12288:qoyHDO2LduT5P6jJVDkU+HZm2wF9xgtnLR3wDL5P6jJVDkU+HZm2wF9xgtnLR3wC:qjdLdqCVVOmxIt3MNCVVOmxIt3M+

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

Victim With Ftp

C2

hassan121.no-ip.biz:80

hassan121.no-ip.biz:81

hassan121.no-ip.biz:82

hassan121.no-ip.biz:83

hassan121.no-ip.biz:84

hassan121.no-ip.biz:85

Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./

  • ftp_interval

    30

  • ftp_password

    racer0987654321

  • ftp_port

    21

  • ftp_server

    spy-net-beta.zxq.net

  • ftp_username

    spy-net-beta_zxq

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    svhost.exe

  • install_flag

    true

  • keylogger_enable_ftp

    true

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    hassan007

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Targets

    • Target

      e354b1f151c5f26041afce687f0d0a57_JaffaCakes118

    • Size

      936KB

    • MD5

      e354b1f151c5f26041afce687f0d0a57

    • SHA1

      4fd0a27c25daa7d4b42110ffaf33f29781f8d3ce

    • SHA256

      099d8111410ae88b77a40a7c415b17d94c53ceb401b5437c35ac076e6cc123e4

    • SHA512

      7332bce808de986ebe926f9190c2157c34c82689c00a0217585c580e18b8c376df3aad76f95875705bc7a069e451e0b40633bd1dea541eea2e4783a5f5cb724e

    • SSDEEP

      12288:qoyHDO2LduT5P6jJVDkU+HZm2wF9xgtnLR3wDL5P6jJVDkU+HZm2wF9xgtnLR3wC:qjdLdqCVVOmxIt3MNCVVOmxIt3M+

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    • Cybergate family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks