General
-
Target
JaffaCakes118_69cc26a8330862cb0cc196b9385aa686
-
Size
652KB
-
Sample
250116-d67r7s1neq
-
MD5
69cc26a8330862cb0cc196b9385aa686
-
SHA1
f89297386a1b185905cf35dc4c11625026790b76
-
SHA256
2b5f78ebd2a92f8bc613eb09530bb29cf6efd34bba6e8bcdbfc7fc8921795fc7
-
SHA512
5bd88b225994c8f68d7bb9b90c0465f0f726afe3928140bc8e52216f7c40e492514476c150d7f78fb21bc83896aa1a50df555d834eecf082439cd66999e6ebe3
-
SSDEEP
12288:mroLgrnL+O1ynwOpN4stjEjoJdiXi5Bx0bDntCyc5MBNeW:mroLgXNynwOpzjEjadiX2IbMTen
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_69cc26a8330862cb0cc196b9385aa686.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_69cc26a8330862cb0cc196b9385aa686.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
cybergate
v1.07.5
3ldiosfenix
¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼ ^77 mea£½½½½½½½½wGKÉ ]#]Éüaa£½½½½½½½½wGGÉÉ ZZ] aa£½½½½½½½½pGGÈ]]ZVZaa£½½½½½½½½pGG ÏXTVVZXaa£½½½½½½½½pGG\ÇÇ¥¢ã86VVVVZ6aa£½½½½½½½½iBG]88à¯ç?::5[TV&48aa£½½½½½½½½iBB_:;¯¯é>>>/%V%;:aa£½½½½½½½½iBB6>=¯¦â000* /0>aa£½½½½½½½½iBB+0ïé0,,,(*,,,0Ha£½½½½½½½½fBBîòñ¯ïìÝÝØÙÕÕÕÕÙØáHa£½½½½½½½½fBBîðªªóììÜÝÙÕÕÕÕÙØáHa£½½½½½½½½fBB3ÍééÍÁ,ÑÑ2**,ÕØÏHa£½½½½½½½½fBB3ÍäÛÍÁ,))B*)Ka£½½½½½½½½LBB3ÍÛÌÍÁ,))**)Ka£½½½½½½½½LBB-ÍÓÍÍÍ,,)**),Ka£½½½½½½½½LBB@3333-.''!!']MKa£½½½½½½½½LBBBBBBBBBBBBGGGGKSgga£½½½½½½½½MBBBBBBBBBBBBGGGGOlq£½½½½½½½½MBBBBBBBBBBBBGGGG{£½½½½½½½½MBBBBBBBBBBBBBBGGnô £½½½½½½½½½HBBBBBBBBBBBBBBGGjmþ£½½½½½½½½½½HBBBBBBBBBBBBBBBGfhø£½½½½½½½½½½½KBBBBBBBBBBBBBBBBf£½½½½½½½½½½½½eaaaaaffjjjjjjrrwj½½½½½½½½½CCCCD¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼£L¼¼L¼¼ÃL¼¼CL¼½C¼¼¼¼¼¼ü¼¼¼½¼´¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¨¼²¼ö¶¶¼ü¼¼ø¥¼é©¼ñ¦¼é ¼÷¼é¼÷¼ï¼æ¼äþ¼Ôô¼ð¼ù¼ é¼ã¼©¦Á¼Ô¼üç¼ÿÙ¼þß¼÷̼÷˼þüï¼Óûú¼øêÁ¼ÚÚÚ¼<¼¼¼Ú¥¼eϼ¼\Ƽ¼9ïî¼-ãâ¼îî¼3Ýæ¼ãÕ¼$ÛÚ¼ÕÖ¼ ÛÖ¼ÏмÇÒ¼ÚμÄϼÆ̼}ÆɼI3¼¼e;¼[)¼A¼:Õ¼>Á¼ 8ȼh.ò¼\.ü¼Rû¼Kÿ¼Cø¼B è¼;Ô¼l6Þ¼t/Ö¼l Ô¼~1Ǽz/ƼbÖ¼fļ^Ó¼CÚ¼^μVʼC|ȼ¾¸%¼ <¼´©¼®¼¼®¼¼¦ì$¼à;¼ä6¼¡Ñ"¼Ü0¼å¼§Ì¼Ô¼ùè=¼òÞ1¼ÀÙ;¼ùË ¼Þ˼©x¼¤t¼ m¼¡þr¼¡ýn¼õe¼îa¼Òh¼ñ]¼ëZ¼ãM¼ÜX¼ÕY¼ÈU¼ØN¼Ñ@¼ÎN¼ÏA¼òËL¼6Í3¼É;¼Â9¼Ã*¼0¼|Â=¼¼¼¼¼Ó?¼Ç5¼ 9W¼?G¼*J¼ø<t¼å?~¼è6n¼å-g¼Õ0w¼Ï0x¼È/t¼Ù3m¼Þ-i¼Í!o¼×e¼Êk¼Ëi¼ö/[¼ï.^¼ÿ6@¼è:A¼ù)D¼á,B¼Ú)A¼çV¼ðA¼îA¼å A¼Õ[¼Í_¼Ö U¼Ê[¼ÕG¼ØH¼ÈE¼ã|C¼Ç{U¼ÞyA¼ÈyI¼ÒoB¼ÅhE¼Æ]C¼ 4%¼0:¼>6¼ .6¼>*¼=,¼--¼0:¼)9¼+.¼?5 ¼6*¼/$¼0¼(¼(¼$¼-¼¼~8>¼u'?¼g+6¼+)¼l )¼G ¼p;¼d:¼w/¼i$¼s)¼f!¼\6¼Y0¼C#¼W,¼L-¼h¼w¼j ¼j¼A¼Y¼D ¼A¼E{6¼W|"¼Kz*¼Cd*¼`x ¼T¼Hw¼Ql¼An¼Uq ¼Fv¼Vo¼Ak¼CY¼?&z¼)'|¼6u¼4{¼=o¼?d¼,O¼=tZ¼>mP¼?eN¼&aC¼9YE¼0NB¼^C¼puw¼iii¼Bvu¼Rj~¼@j¼[ao¼Gbo¼B^z¼CI~¼WXa¼BUi¼aZG¼[ZY¼NQU¼AOT¼_WK¼_NG¼A@F¼¼¼¼¼½½½½½½½½½½½½½½½½½½½½½½½½½½½½½½½½½½½½½£££££££££££££££££££££££½½½½½½½½}}}}}}}£½½½½½½½½vOMMMMMMMMMMMMMMMMMMMo£½½½½½½½½vKKKKHHHHaaaaaaaaeeeea£½½½½½½½½vKKKKKHHHHaaaaaaaaeeea£½½½½½½½½vFKKKKKHHHHaaaaaaaaeea£½½½½½½½½wFKQ ^77 mea£½½½½½½½½wGKÉ ]#]Éüaa£½½½½½½½½wGGÉÉ ZZ] aa£½½½½½½½½pGGÈ]]ZVZaa£½½½½½½½½pGG ÏXTVVZXaa£½½½½½½½½pGG\ÇÇ¥¢ã86VVVVZ6aa£½½½½½½½½iBG]88à¯ç?::5[TV&48aa£½½½½½½½½iBB_:;¯¯é>>>/%V%;:aa£½½½½½½½½iBB6>=¯¦â000* /0>aa£½½½½½½½½iBB+0ïé0,,,(*,,,0Ha£½½½½½½½½fBBîòñ¯ïìÝÝØÙÕÕÕÕÙØáHa£½½½½½½½½fBBîðªªóììÜÝÙÕÕÕÕÙØáHa£½½½½½½½½fBB3ÍééÍÁ,ÑÑ2**,ÕØÏHa£½½½½½½½½fBB3ÍäÛÍÁ,))B*)Ka£½½½½½½½½LBB3ÍÛÌÍÁ,))**)Ka£½½½½½½½½LBB-ÍÓÍÍÍ,,)**),Ka£½½½½½½½½LBB@3333-.''!!']MKa£½½½½½½½½LBBBBBBBBBBBBGGGGKSgga£½½½½½½½½MBBBBBBBBBBBBGGGGOlq£½½½½½½½½MBBBBBBBBBBBBGGGG{£½½½½½½½½MBBBBBBBBBBBBBBGGnô £½½½½½½½½½HBBBBBBBBBBBBBBGGjmþ£½½½½½½½½½½HBBBBBBBBBBBBBBBGfhø£½½½½½½½½½½½KBBBBBBBBBBBBBBBBf£½½½½½½½½½½½½eaaaaaffjjjjjjrrwj½½½½½½½½½CCCCD¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼£L¼¼L¼¼ÃL¼¼CL¼½C0c$ÇÅ͵³«¼¼¼p¼¼¼¼£¼¼¼½Øïèéþ¼¬hþÝÏÙ¼°÷ëÕÒØÓËϼ¼{ïÅÏÈÙѼ¼=ïÅÏõÒÕȼ¬éèÅÌÙϼ¬ÉõùãØÙßÓØÙ¼¼°éÒÕÈøÕÊÙÎÏÓϼ ?èÐôÙÐ̼¼ÛéÒÕÈïÙÎÊÙÎéÈÕÐϼ &ýßÐýìõ¼°ýýßßÿÈÎм |ËßÎÅÌȼ¬÷ÉéîðôÕÏÈÓÎż¬ÏýßÈÕÊÙä¼°ñÙÏÏÝÛÙϼ¬JÿÎÅÌÈýÌÕ¼¬ÉîýïîÙÝØÙμ¬tõùÌÝÏÏËÓÎØϼ¬uìÏÈÓÎÙßÐÕÞ¼¬ïìïèóîùÿðÕÞãèðþ¼¬ÉÒÕÈïÈÝÎÈÉ̼¬UéÒÕÈÿÓÑÝÒØÓϼ¼ØÙÐÙÈÙéÒÕȼ¼uéÒÕÈìÝÏÏËÓÎØϼ¼ùØÕÈïÊμ¼%éÒÕÈõÒÏÈÝÐÝßÝÓ¼¼ééÒÕÈïÙÈÈÕÒÛϼ¼îéÒÕÈêÝÎÕÝÊÙÕϼ¼éÒÕÈïÝÒØþÓļ¼éÒÕÈõÒÖÙßÈðÕÞÎÝÎż¼¼¼3ldiosfenix.no-ip.org:3080
2F1MVDCT882ION
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
ftp_password
jfc/sbn9674517
-
ftp_port
21
-
ftp_server
ftp.webcindario.com
-
ftp_username
by3ldiosfenix
-
injected_process
explorer.exe
-
install_dir
system32
-
install_file
win32.exe
-
install_flag
true
-
keylogger_enable_ftp
true
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
1234
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Targets
-
-
Target
JaffaCakes118_69cc26a8330862cb0cc196b9385aa686
-
Size
652KB
-
MD5
69cc26a8330862cb0cc196b9385aa686
-
SHA1
f89297386a1b185905cf35dc4c11625026790b76
-
SHA256
2b5f78ebd2a92f8bc613eb09530bb29cf6efd34bba6e8bcdbfc7fc8921795fc7
-
SHA512
5bd88b225994c8f68d7bb9b90c0465f0f726afe3928140bc8e52216f7c40e492514476c150d7f78fb21bc83896aa1a50df555d834eecf082439cd66999e6ebe3
-
SSDEEP
12288:mroLgrnL+O1ynwOpN4stjEjoJdiXi5Bx0bDntCyc5MBNeW:mroLgXNynwOpzjEjadiX2IbMTen
-
Cybergate family
-
Adds policy Run key to start application
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Adds Run key to start application
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-