Overview

overview

10

Static

static

3

JaffaCakes...90.exe

windows7-x64

10

JaffaCakes...90.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_6abf933172aada764bfe1a2b4b1eac90

  • Size

    339KB

  • Sample

    250103-g4gd1sslfx

  • MD5

    6abf933172aada764bfe1a2b4b1eac90

  • SHA1

    28d2c603e547ac4ea8d83bf8cd142aa7821e5597

  • SHA256

    85a53519e1ab04509b6daaa30cb381a7830b990e0f06af6b9bc7f9612e80d4df

  • SHA512

    adeb854cd4d16c6ea08e8942ac62ed9c52152a96092dddadc113bea0e6dd65bbf71d30d845dcd3243de7dee67cbfd937a86887dc5f851973829639f1b3399093

  • SSDEEP

    6144:rxL3BJmt3/8DhQjpzLZNqN3jPg0p/HTEZm70azTQIHXCz4:VrOx/8DhQlzLZNO3jPg0+Zm70yQka

Score
10/10
cybergatebummdiscoverypersistencestealertrojanupx

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

bumm

C2

tukashikato.no-ip.info:8418

Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    true

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    svchost.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Error loading the specified module could not be found

  • message_box_title

    RUNDLL

  • password

    111111

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Targets

    • Target

      JaffaCakes118_6abf933172aada764bfe1a2b4b1eac90

    • Size

      339KB

    • MD5

      6abf933172aada764bfe1a2b4b1eac90

    • SHA1

      28d2c603e547ac4ea8d83bf8cd142aa7821e5597

    • SHA256

      85a53519e1ab04509b6daaa30cb381a7830b990e0f06af6b9bc7f9612e80d4df

    • SHA512

      adeb854cd4d16c6ea08e8942ac62ed9c52152a96092dddadc113bea0e6dd65bbf71d30d845dcd3243de7dee67cbfd937a86887dc5f851973829639f1b3399093

    • SSDEEP

      6144:rxL3BJmt3/8DhQjpzLZNqN3jPg0p/HTEZm70azTQIHXCz4:VrOx/8DhQlzLZNO3jPg0+Zm70yQka

    Score
    10/10
    cybergatebummdiscoverypersistencestealertrojanupx

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

      trojanstealercybergate

    • Cybergate family

      cybergate

    • Adds policy Run key to start application

      persistence

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks