Overview

overview

10

Static

static

10

JaffaCakes...70.exe

windows7-x64

10

JaffaCakes...70.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_6d3a5b1535b2f704d15116beff296970

  • Size

    280KB

  • MD5

    6d3a5b1535b2f704d15116beff296970

  • SHA1

    cd1b31808c98abbbeeb8cfc8f2c26ab9e9779638

  • SHA256

    9aae6cffdf2d63477eec07ac50ed55d7567a061d63630f748d6b422dd046f2b2

  • SHA512

    93545271be112d42d56dbe0956f49c074919879650eff5bfa80670aa7cc022963a4c4f3ba3b201d096fdd393a72b90981c4e8377fd5f998f208099df3d642696

  • SSDEEP

    6144:O3LZlsxZZQttyCVxaWYSdMU/77hlruc6XmDoTbcI7CPPdh:K/eAtpVxagMU/plruchDofAPH

Score
10/10
slavecybergate

Malware Config

Extracted

Family

cybergate

Version

v1.02.0

Botnet

slave

C2

185.5.175.205:1336

Mutex

HX218Y5F488K37

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    csrss.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_title

    An error occured

  • password

    molly

  • regkey_hkcu

    HKCU

Signatures

  • Cybergate family
    cybergate
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • JaffaCakes118_6d3a5b1535b2f704d15116beff296970
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections