Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
JaffaCakes118_45e718c0ce3b9bb33b9e3f73ccd18ce1
-
Size
342KB
-
Sample
250114-1ae4mssncn
-
MD5
45e718c0ce3b9bb33b9e3f73ccd18ce1
-
SHA1
c87236f6a3d0f98f1479cb048a7e1ad3f59d426e
-
SHA256
1a5d6d7ef8ffa2f11789250fdc9c7a0f744ef9167d3e470246a3dee9d2be18af
-
SHA512
d9b5fabbfaa2f39a19d919ce5c841d881edb1743cd5126e61ac20650341ca0d01040a40e438782ae9a87a2ab02c0936bf40bb23c656f892476f6cb9a60388efc
-
SSDEEP
6144:ykWHgIbXpjuhxlT7OH2cy1W43i1fbIR8SF7bu8uHnwGGGak0Jx:yXHgqtwvTXcyY43mfclhGKk0
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_45e718c0ce3b9bb33b9e3f73ccd18ce1.exe
Resource
win7-20240903-en
Malware Config
Extracted
cybergate
v1.04.8
x0x
as1234.zapto.org:4563
TN0YT208B55WMC
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
install
-
install_file
server.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
cybergate
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Targets
-
-
Target
JaffaCakes118_45e718c0ce3b9bb33b9e3f73ccd18ce1
-
Size
342KB
-
MD5
45e718c0ce3b9bb33b9e3f73ccd18ce1
-
SHA1
c87236f6a3d0f98f1479cb048a7e1ad3f59d426e
-
SHA256
1a5d6d7ef8ffa2f11789250fdc9c7a0f744ef9167d3e470246a3dee9d2be18af
-
SHA512
d9b5fabbfaa2f39a19d919ce5c841d881edb1743cd5126e61ac20650341ca0d01040a40e438782ae9a87a2ab02c0936bf40bb23c656f892476f6cb9a60388efc
-
SSDEEP
6144:ykWHgIbXpjuhxlT7OH2cy1W43i1fbIR8SF7bu8uHnwGGGak0Jx:yXHgqtwvTXcyY43mfclhGKk0
-
Cybergate family
-
Adds policy Run key to start application
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Suspicious use of SetThreadContext
-