Overview

overview

10

Static

static

3

fb6e387e44...18.exe

windows7-x64

10

fb6e387e44...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fb6e387e4473053dce0729f7b5cc0023_JaffaCakes118

  • Size

    768KB

  • Sample

    241218-n2aa9aypcp

  • MD5

    fb6e387e4473053dce0729f7b5cc0023

  • SHA1

    00830b98705127d73e09ff9025b099cc0517c479

  • SHA256

    0c35b7a5791d36a78dd3abb6a6d0f6927ac0783a52a62132f319083d047ffb3a

  • SHA512

    f32e1d2fae2158891cab521f967d876e04672a93c1e0d9b4b176ae72ea72d208131651a03da2539dc947b4531715157b97fe43bee1439b8bb3972f9d3e0c89a0

  • SSDEEP

    12288:quJ0WQdr9c7V0/Gj/jcpmDM3ZMqq4TKy0Dw+dvfwFwp3tAVwjHVzYKj86sQ1Sm:qfJd5c7VDJDM3ZM0+3s+BoF7QpYOb1R

Score
10/10
cybergateöííébootkitdiscoverypersistencestealertrojanupx

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

ÖÍíÉ

C2

127.0.0.1:83

Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    svchost.exe

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

Targets

    • Target

      fb6e387e4473053dce0729f7b5cc0023_JaffaCakes118

    • Size

      768KB

    • MD5

      fb6e387e4473053dce0729f7b5cc0023

    • SHA1

      00830b98705127d73e09ff9025b099cc0517c479

    • SHA256

      0c35b7a5791d36a78dd3abb6a6d0f6927ac0783a52a62132f319083d047ffb3a

    • SHA512

      f32e1d2fae2158891cab521f967d876e04672a93c1e0d9b4b176ae72ea72d208131651a03da2539dc947b4531715157b97fe43bee1439b8bb3972f9d3e0c89a0

    • SSDEEP

      12288:quJ0WQdr9c7V0/Gj/jcpmDM3ZMqq4TKy0Dw+dvfwFwp3tAVwjHVzYKj86sQ1Sm:qfJd5c7VDJDM3ZM0+3s+BoF7QpYOb1R

    Score
    10/10
    cybergateöííébootkitdiscoverypersistencestealertrojanupx

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

      trojanstealercybergate

    • Cybergate family

      cybergate

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks