Overview

overview

10

Static

static

3

JaffaCakes...5f.exe

windows7-x64

10

JaffaCakes...5f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_09ba1497d0cf9e7cb3efe75f0eb2c85f

  • Size

    584KB

  • Sample

    250112-j2tyfawndm

  • MD5

    09ba1497d0cf9e7cb3efe75f0eb2c85f

  • SHA1

    4d85c7cc30c407dccd12af90c60005bae7c7f3c7

  • SHA256

    171964dfd8d764fce734342fa9b10e12bcbb6a15f984fd8171221269005394f5

  • SHA512

    b0415dc1524d94155d191eef2c8c68af92c754b2853056492a11878784353f88a933e0b1fe40c42cf1bc762d11dfc45ddbbf765a0b71f0b5f3951a9518532ad2

  • SSDEEP

    12288:Cdp6pBXY2Od6WV2w1cWA4pl8cBQMWMrLt5WlOu2zFJVX7Ql3EqSK:CzGYpdvV44plDAit5wSFJZ7Q

Score
10/10
cybergateöííêídiscoverypersistencestealertrojanupx

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

ÖÍíÊí

C2

mahdidi.zapto.org:999

Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    svchost.exe

  • install_file

    windows.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    t?tulo da mensagem

  • password

    abcd1234

Targets

    • Target

      JaffaCakes118_09ba1497d0cf9e7cb3efe75f0eb2c85f

    • Size

      584KB

    • MD5

      09ba1497d0cf9e7cb3efe75f0eb2c85f

    • SHA1

      4d85c7cc30c407dccd12af90c60005bae7c7f3c7

    • SHA256

      171964dfd8d764fce734342fa9b10e12bcbb6a15f984fd8171221269005394f5

    • SHA512

      b0415dc1524d94155d191eef2c8c68af92c754b2853056492a11878784353f88a933e0b1fe40c42cf1bc762d11dfc45ddbbf765a0b71f0b5f3951a9518532ad2

    • SSDEEP

      12288:Cdp6pBXY2Od6WV2w1cWA4pl8cBQMWMrLt5WlOu2zFJVX7Ql3EqSK:CzGYpdvV44plDAit5wSFJZ7Q

    Score
    10/10
    cybergateöííêídiscoverypersistencestealertrojanupx

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

      trojanstealercybergate

    • Cybergate family

      cybergate

    • Adds policy Run key to start application

      persistence

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks