Overview

overview

10

Static

static

3

JaffaCakes...00.exe

windows7-x64

10

JaffaCakes...00.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_7c3eb2e69062fb9b20c25df818ed6f00

  • Size

    202KB

  • Sample

    250104-1699nazpat

  • MD5

    7c3eb2e69062fb9b20c25df818ed6f00

  • SHA1

    1021d120b28f99b90af504c93926dde48804a8fb

  • SHA256

    276691a16fe41df718f09b69876e4f525a68200dd5b282733f3b8be2db1bfadf

  • SHA512

    737ad272d62b5c1a1ebf94830780a03d11e8177d8a6556a61e1c8f9100dfdcd1424aba308e2f04d8cf53eb0c492ecccd7270e1700a6ac332a154ab76ba1d5e6e

  • SSDEEP

    3072:IopGtIX+LOWtxaD271t2KVco5mFXWvTnHrW1oUCDjmFvlk1wZChDNY:pXqdtxaD271tfVV5mFIe1ojq6qWNY

Score
10/10
cybergatecrackerdiscoverystealertrojan

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

Cracker

C2

192168.no-ip.org:88

crackerfull.no-ip.org:87

crackerfull.no-ip.org:88
Mutex

2R7O2P55S36KO7

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    svchost.exe

  • install_file

    csrss.dll

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    123

Targets

    • Target

      JaffaCakes118_7c3eb2e69062fb9b20c25df818ed6f00

    • Size

      202KB

    • MD5

      7c3eb2e69062fb9b20c25df818ed6f00

    • SHA1

      1021d120b28f99b90af504c93926dde48804a8fb

    • SHA256

      276691a16fe41df718f09b69876e4f525a68200dd5b282733f3b8be2db1bfadf

    • SHA512

      737ad272d62b5c1a1ebf94830780a03d11e8177d8a6556a61e1c8f9100dfdcd1424aba308e2f04d8cf53eb0c492ecccd7270e1700a6ac332a154ab76ba1d5e6e

    • SSDEEP

      3072:IopGtIX+LOWtxaD271t2KVco5mFXWvTnHrW1oUCDjmFvlk1wZChDNY:pXqdtxaD271tfVV5mFIe1ojq6qWNY

    Score
    10/10
    cybergatecrackerdiscoverystealertrojan

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

      trojanstealercybergate

    • Cybergate family

      cybergate

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks