Overview

overview

10

Static

static

3

e8a8adeb50...18.exe

windows7-x64

10

e8a8adeb50...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e8a8adeb50964571250f3769187202a5_JaffaCakes118

  • Size

    308KB

  • Sample

    241212-2tt8caznaw

  • MD5

    e8a8adeb50964571250f3769187202a5

  • SHA1

    d74658e60694978cadc1844cf866fd60ed964b1d

  • SHA256

    55010227e1f86b3b99c53fc48fefd9c9871f46a4b50b55cac8a9d422e8322adb

  • SHA512

    1c55c5e42f32b72e13f2585a757e2c3cf2be13c67cf5dfad0268c4175cc40a20f4134d7f6c3e926b072b0000e54c71fb0479ea8b30f3f5905decb69e6f84605d

  • SSDEEP

    6144:GmXKAODNsLtTDZ71M8xkpiZrwnjKRfMZIR+2OZzZrGqSrmHe9BIbhqrl6gIWi:QAm2LhtcpiUmSEOeqSB9abh06ge

Score
10/10
cybergatevctimdiscoverypersistencestealertrojanupx

Malware Config

Extracted

Family

cybergate

Version

2.7 Beta 02

Botnet

Vctim

C2

127.0.0.1:81

default121.no-ip.biz:81
Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    true

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Konnte Splinter Cell nicht laden.

  • message_box_title

    Fehler

  • password

    abcd1234

  • regkey_hklm

    HKLM

Targets

    • Target

      e8a8adeb50964571250f3769187202a5_JaffaCakes118

    • Size

      308KB

    • MD5

      e8a8adeb50964571250f3769187202a5

    • SHA1

      d74658e60694978cadc1844cf866fd60ed964b1d

    • SHA256

      55010227e1f86b3b99c53fc48fefd9c9871f46a4b50b55cac8a9d422e8322adb

    • SHA512

      1c55c5e42f32b72e13f2585a757e2c3cf2be13c67cf5dfad0268c4175cc40a20f4134d7f6c3e926b072b0000e54c71fb0479ea8b30f3f5905decb69e6f84605d

    • SSDEEP

      6144:GmXKAODNsLtTDZ71M8xkpiZrwnjKRfMZIR+2OZzZrGqSrmHe9BIbhqrl6gIWi:QAm2LhtcpiUmSEOeqSB9abh06ge

    Score
    10/10
    cybergatevctimdiscoverypersistencestealertrojanupx

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

      trojanstealercybergate

    • Cybergate family

      cybergate

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks