Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
fc77d5b16cbfa04164c39a6dd5c06d3b_JaffaCakes118.exe
Resource
win7-20241010-en
General
-
Target
fc77d5b16cbfa04164c39a6dd5c06d3b_JaffaCakes118
-
Size
324KB
-
MD5
fc77d5b16cbfa04164c39a6dd5c06d3b
-
SHA1
21a2f988d51ee2b5aee1d3504be2f46ba410a370
-
SHA256
f48eda12f0a80133aa66bc08d8cb041f52fca49348b3be139578f6152b4a915d
-
SHA512
9caf10e0db5fd251b3e6927e96c712ebb88caa01bd514ee24823823de010fda5ebbaeee7580a3360ada8ae559d7826fedace0a9c816564c1ea7e6bc9e9b5d0b4
-
SSDEEP
6144:24ABFdX3pAuO/50BTnyZsSaXhh4XAS79hO9R0O91FG+9IVUCt:NUX0GLyWSKaAS79MEqfGHU
Malware Config
Extracted
cybergate
v1.05.1
Test
pawngamer.no-ip.org:999
26R2851CD40767
-
enable_keylogger
false
-
enable_message_box
false
-
ftp_directory
./
-
ftp_interval
30
-
ftp_password
Killer22
-
ftp_port
21
-
ftp_server
www3.subdomain.com
-
ftp_username
user912900
-
injected_process
explorer.exe
-
install_dir
System32
-
install_file
windows update.exe
-
install_flag
true
-
keylogger_enable_ftp
true
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
Test
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
Files
-
fc77d5b16cbfa04164c39a6dd5c06d3b_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
UPX0 Size: 60KB - Virtual size: 60KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 261KB - Virtual size: 264KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE