Overview

overview

10

Static

static

10

JaffaCakes...fe.exe

windows7-x64

10

JaffaCakes...fe.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_6ee1fd3116dc07f9f0d45a375c9f2afe

  • Size

    364KB

  • MD5

    6ee1fd3116dc07f9f0d45a375c9f2afe

  • SHA1

    8e491dd1a30da4c6739fcfc42adf67e7a57f2ecf

  • SHA256

    fb094677ce3ee9fde1245465271715b35cf52eebf3606720104961e197db12ef

  • SHA512

    38c919263fd3651fc41940208f1fa25c793cff85bd7c98f29ff55e476be6ed9c66e2c18c62e8f0cdcf0e40ae5f46cd3e6e726de9777fd648449412414eeffa65

  • SSDEEP

    6144:YOpslFlqmmyOQzChdBCkWYxuukP1pjSKSNVkq/MVJbW:YwsloFQWTBd47GLRMTbW

Score
10/10
barajagcybergate

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

barajag

C2

gurgelgurka.no-ip.biz:100

Mutex

4GO70G6W454UA1

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    WinDir

  • install_file

    Svchost.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    123456

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • Cybergate family
    cybergate
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • JaffaCakes118_6ee1fd3116dc07f9f0d45a375c9f2afe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections