Overview

overview

10

Static

static

3

JaffaCakes...30.exe

windows7-x64

10

JaffaCakes...30.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_6a206fa0f9854bd20c92012be0913e30

  • Size

    764KB

  • Sample

    250103-epmlda1ram

  • MD5

    6a206fa0f9854bd20c92012be0913e30

  • SHA1

    3f87ee80e183e06f99fe0498d88241c772fd8d1e

  • SHA256

    41b4425ab411a105d5eef373f87b68afcfd442531f72c0822c04edf7c72cca98

  • SHA512

    d16266e2b97d2bb0a47a870857a653d32990b801a224c6889d59f1f8a9c758221aee5a0f7e926f03608c18a5628f0ab4ecdb9339d9afbdfb770ffb93fc09ebea

  • SSDEEP

    12288:3kJfG2aVHQ7+lZ4MteS7ZIC2bNf7Og/5wCL0iE+bhy4Y7hk0P5t0EmjUXll5J:3EfOdQ74fve5bNNxLL0ifFyLk1m3

Score
10/10
cybergateat-6discoverypersistencestealertrojanupx

Malware Config

Extracted

Family

cybergate

Version

2.7 Final

Botnet

AT-6

C2

127.0.0.1:10001

c4tnt.no-ip.biz:10001

192.168.1.4:10001
Mutex

***cv1544684864fsqfvcxv***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    Microsoft

  • install_file

    svchost.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    1234

  • regkey_hkcu

    HKCU

Targets

    • Target

      JaffaCakes118_6a206fa0f9854bd20c92012be0913e30

    • Size

      764KB

    • MD5

      6a206fa0f9854bd20c92012be0913e30

    • SHA1

      3f87ee80e183e06f99fe0498d88241c772fd8d1e

    • SHA256

      41b4425ab411a105d5eef373f87b68afcfd442531f72c0822c04edf7c72cca98

    • SHA512

      d16266e2b97d2bb0a47a870857a653d32990b801a224c6889d59f1f8a9c758221aee5a0f7e926f03608c18a5628f0ab4ecdb9339d9afbdfb770ffb93fc09ebea

    • SSDEEP

      12288:3kJfG2aVHQ7+lZ4MteS7ZIC2bNf7Og/5wCL0iE+bhy4Y7hk0P5t0EmjUXll5J:3EfOdQ74fve5bNNxLL0ifFyLk1m3

    Score
    10/10
    cybergateat-6discoverypersistencestealertrojanupx

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

      trojanstealercybergate

    • Cybergate family

      cybergate

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks