Overview

overview

10

Static

static

3

JaffaCakes...43.exe

windows7-x64

10

JaffaCakes...43.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_60e2c4748cb369963ade5d5e93eba743

  • Size

    328KB

  • Sample

    250101-1vv1laypdk

  • MD5

    60e2c4748cb369963ade5d5e93eba743

  • SHA1

    adc5b8b45748cf5220f5617616dae761390bd70d

  • SHA256

    923ad557f320679ed043446a3cb9e8dfa49313202904669c8cfdf5bd55120784

  • SHA512

    672f7850b8790ef959f2abaef3744cb593fe99ae62585b2001f407006ffd9c9a3cddb69905f15c0568a170289426c0ee45284dd6f041fb581dcce0a7e282c71a

  • SSDEEP

    6144:dlWbPESlzd91X0UbsDuta1gnQ6yc9b/OiZ9mKpoUh/hy3Y+vLyMI72/1E3:dQbsSXToDurQVcx/F9lp7/MI+GuE3

Score
10/10
cybergatecybergate15444discoverystealertrojan

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

Cybergate15444

C2

danaibrahim.zapto.org:15444

Mutex

3R602X51T6XEV5

Attributes
  • enable_keylogger

    true

  • enable_message_box

    true

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    bader.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Windows can't open this application!

  • message_box_title

    Error

  • password

    14931

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Targets

    • Target

      JaffaCakes118_60e2c4748cb369963ade5d5e93eba743

    • Size

      328KB

    • MD5

      60e2c4748cb369963ade5d5e93eba743

    • SHA1

      adc5b8b45748cf5220f5617616dae761390bd70d

    • SHA256

      923ad557f320679ed043446a3cb9e8dfa49313202904669c8cfdf5bd55120784

    • SHA512

      672f7850b8790ef959f2abaef3744cb593fe99ae62585b2001f407006ffd9c9a3cddb69905f15c0568a170289426c0ee45284dd6f041fb581dcce0a7e282c71a

    • SSDEEP

      6144:dlWbPESlzd91X0UbsDuta1gnQ6yc9b/OiZ9mKpoUh/hy3Y+vLyMI72/1E3:dQbsSXToDurQVcx/F9lp7/MI+GuE3

    Score
    10/10
    cybergatecybergate15444discoverystealertrojan

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

      trojanstealercybergate

    • Cybergate family

      cybergate

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks