Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    JaffaCakes118_3edf45cc46b3fa7c7d0dcd621bc35c4a

  • Size

    281KB

  • Sample

    250114-rt82dszqfy

  • MD5

    3edf45cc46b3fa7c7d0dcd621bc35c4a

  • SHA1

    3ced0c2bb7a1055700f1b738af553a36383d8737

  • SHA256

    2e5e5ba859642abb1b6d58ec19bf15d180507bce89a3f6cf4df9b51fcb60e8e3

  • SHA512

    3303b50e5353a7cafe658cdb70a05dd196ebb68fd9ccb0d16f0cdd069703b0fa42110e03ede667ea590dbe70dbe060dbc2e5c103218b6b1ecf35fa397d65b541

  • SSDEEP

    6144:FS5p9VHFVvXKkWbmHCSkM0qdrsQCfhaCvsqG4v1p0HbCtJ:Q3vFFnWb42MuQk2wp0HOtJ

Malware Config

Extracted

Family

cybergate

Version

v1.20.11 - Trial

Botnet

rush

C2

somidavid.tzo.net:80

Mutex

24UV504BYXL456

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    sofeek

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Targets

    • Target

      JaffaCakes118_3edf45cc46b3fa7c7d0dcd621bc35c4a

    • Size

      281KB

    • MD5

      3edf45cc46b3fa7c7d0dcd621bc35c4a

    • SHA1

      3ced0c2bb7a1055700f1b738af553a36383d8737

    • SHA256

      2e5e5ba859642abb1b6d58ec19bf15d180507bce89a3f6cf4df9b51fcb60e8e3

    • SHA512

      3303b50e5353a7cafe658cdb70a05dd196ebb68fd9ccb0d16f0cdd069703b0fa42110e03ede667ea590dbe70dbe060dbc2e5c103218b6b1ecf35fa397d65b541

    • SSDEEP

      6144:FS5p9VHFVvXKkWbmHCSkM0qdrsQCfhaCvsqG4v1p0HbCtJ:Q3vFFnWb42MuQk2wp0HOtJ

    • CyberGate, Rebhip

      CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    • Cybergate family

    • Adds policy Run key to start application

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Adds Run key to start application

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.