Overview

overview

10

Static

static

3

JaffaCakes...8d.exe

windows7-x64

10

JaffaCakes...8d.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_61624ad1d5c4f1fd2e7d67abde61ee8d

  • Size

    266KB

  • Sample

    250101-3wljna1pfv

  • MD5

    61624ad1d5c4f1fd2e7d67abde61ee8d

  • SHA1

    999924d5da06889becb62fa212fe406e91ceb76d

  • SHA256

    7aa2b89bbbd7f8c32a761df69e8e15a9ec646f1e0fd4d66b78b61b1b3b508f96

  • SHA512

    c2726c04125d5a241299612870cadc4cd4b9a7b8676ff3e667075868c3082a1fda634b84131aeb759ec3f4d6dd6d68400bf98ebd9686999803107f29873363f9

  • SSDEEP

    3072:FJcFJ+kcRhP5JuXLFG3Oa95BrKUqEQ94jhc3PQuPe2D2ue3NXR0jW/UCFnp7HBIZ:gqD5JGmrpQsK3RD2u270jupCJsCxCC

Score
10/10
cybergatediscoverypersistencestealertrojanupx

Malware Config

Targets

    • Target

      JaffaCakes118_61624ad1d5c4f1fd2e7d67abde61ee8d

    • Size

      266KB

    • MD5

      61624ad1d5c4f1fd2e7d67abde61ee8d

    • SHA1

      999924d5da06889becb62fa212fe406e91ceb76d

    • SHA256

      7aa2b89bbbd7f8c32a761df69e8e15a9ec646f1e0fd4d66b78b61b1b3b508f96

    • SHA512

      c2726c04125d5a241299612870cadc4cd4b9a7b8676ff3e667075868c3082a1fda634b84131aeb759ec3f4d6dd6d68400bf98ebd9686999803107f29873363f9

    • SSDEEP

      3072:FJcFJ+kcRhP5JuXLFG3Oa95BrKUqEQ94jhc3PQuPe2D2ue3NXR0jW/UCFnp7HBIZ:gqD5JGmrpQsK3RD2u270jupCJsCxCC

    Score
    10/10
    cybergatediscoverypersistencestealertrojanupx

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

      trojanstealercybergate

    • Cybergate family

      cybergate

    • Adds policy Run key to start application

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks