Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
16-01-2025 03:38
General
-
Target
JaffaCakes118_69cc26a8330862cb0cc196b9385aa686.exe
-
Size
652KB
-
MD5
69cc26a8330862cb0cc196b9385aa686
-
SHA1
f89297386a1b185905cf35dc4c11625026790b76
-
SHA256
2b5f78ebd2a92f8bc613eb09530bb29cf6efd34bba6e8bcdbfc7fc8921795fc7
-
SHA512
5bd88b225994c8f68d7bb9b90c0465f0f726afe3928140bc8e52216f7c40e492514476c150d7f78fb21bc83896aa1a50df555d834eecf082439cd66999e6ebe3
-
SSDEEP
12288:mroLgrnL+O1ynwOpN4stjEjoJdiXi5Bx0bDntCyc5MBNeW:mroLgXNynwOpzjEjadiX2IbMTen
Malware Config
Extracted
cybergate
v1.07.5
3ldiosfenix
¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼ ^77 mea£½½½½½½½½wGKÉ ] #]Éüaa£½½½½½½½½wGGÉÉ ZZ] aa£½½½½½½½½pGGÈ]]ZVZaa£½½½½½½½½pGG ÏXTVVZXaa£½½½½½½½½pGG\ÇÇ¥¢ã86VVVVZ6aa£½½½½½½½½iBG]88à¯ç?::5[TV&48aa£½½½½½½½½iBB_:;¯¯é>>>/% V%;:aa£½½½½½½½½iBB6>=¯¦â000* /0>aa£½½½½½½½½iBB+0ïé0,,,(* ,,,0Ha£½½½½½½½½fBBîòñ¯ïìÝÝØÙÕÕÕÕÙØáHa£½½½½½½½½fBBîðªªóììÜÝÙÕÕÕÕÙØáHa£½½½½½½½½fBB3ÍééÍÁ,ÑÑ2* *,ÕØÏHa£½½½½½½½½fBB3ÍäÛÍÁ,)) B *)Ka£½½½½½½½½LBB3ÍÛÌÍÁ,))* *)Ka£½½½½½½½½LBB-ÍÓÍÍÍ,,)* *),Ka£½½½½½½½½LBB@3333-.''! !']MKa£½½½½½½½½LBBBBBBBBBBBBGGGGKSgga£½½½½½½½½MBBBBBBBBBBBBGGGGOlq£½½½½½½½½MBBBBBBBBBBBBGGGG{£½½½½½½½½MBBBBBBBBBBBBBBGGnô £½½½½½½½½½HBBBBBBBBBBBBBBGGjmþ£½½½½½½½½½½HBBBBBBBBBBBBBBBGfhø£½½½½½½½½½½½KBBBBBBBBBBBBBBBBf£½½½½½½½½½½½½eaaaaaffjjjjjjrrwj½½½½½½½½½CCCCD¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼£L¼¼L¼¼ÃL¼¼CL¼½C¼¼¼¼¼¼ü¼¼¼½¼´¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¼¨¼²¼ö¶¶¼ü¼¼ø¥¼é©¼ñ¦¼é ¼÷¼é¼÷¼ï¼æ¼äþ¼Ôô¼ð¼ù¼ é¼ã¼©¦Á¼Ô¼üç¼ÿÙ¼þß¼÷̼÷˼þüï¼Óûú¼øêÁ¼ÚÚÚ¼<¼¼¼Ú¥¼eϼ¼\Ƽ¼9ïî¼-ãâ¼ îî¼3Ýæ¼ãÕ¼$ÛÚ¼ÕÖ¼ ÛÖ¼ÏмÇÒ¼ ÚμÄϼÆ̼}ÆɼI3¼¼e;¼[)¼A¼:Õ¼>Á¼ 8ȼh.ò¼\.ü¼R û¼Kÿ¼C ø¼B è¼;Ô¼l6Þ¼t/Ö¼l Ô¼~1Ǽz/Ƽb Ö¼fļ^ Ó¼CÚ¼^μVʼC|ȼ¾¸%¼ <¼´©¼®¼¼®¼¼¦ì$¼à;¼ä6¼¡Ñ"¼Ü0¼å¼§Ì¼Ô¼ùè=¼òÞ1¼ÀÙ;¼ùË ¼Þ˼©x¼¤t¼ m¼¡þr¼¡ýn¼õe¼îa¼Òh¼ñ]¼ëZ¼ãM¼ÜX¼ÕY¼ÈU¼ØN¼Ñ@¼ÎN¼ÏA¼òËL¼6Í3¼É;¼Â9¼ Ã*¼0 ¼|Â=¼¼¼¼¼Ó? ¼Ç5¼ 9W¼?G¼*J¼ø<t¼å?~¼è6n¼å-g¼Õ0w¼Ï0x¼È/t¼Ù3m¼Þ-i¼Í!o¼× e¼Êk¼Ëi¼ö/[¼ï.^¼ÿ6@¼è:A¼ù)D¼á,B¼Ú)A¼çV¼ð A¼îA¼å A¼Õ[¼Í _¼Ö U¼Ê[¼ÕG¼ØH¼ÈE¼ã|C¼Ç{U¼ÞyA¼ÈyI¼ÒoB¼ÅhE¼Æ]C¼ 4%¼0:¼>6¼ .6¼>*¼ =,¼--¼0:¼)9¼+.¼?5 ¼6*¼/$ ¼ 0 ¼(¼ ( ¼$¼- ¼¼~8>¼u'?¼g+6¼+)¼l )¼G ¼p;¼d:¼w/¼i$¼s )¼f!¼\6¼Y0¼C #¼W,¼L-¼h¼w¼j ¼j ¼A¼Y ¼D ¼A ¼E{6¼W|"¼Kz*¼Cd*¼`x ¼T¼Hw¼Ql¼An¼Uq ¼Fv¼Vo¼Ak ¼CY¼?&z¼)'|¼6u¼4 {¼= o¼? d¼,O¼=tZ¼>mP¼?eN¼&aC¼9YE¼0NB¼^C¼puw¼iii¼Bvu¼Rj~¼@j¼[ao¼Gbo¼B^z¼CI~¼WXa¼BUi¼aZG¼[ZY¼NQU¼AOT¼_WK¼_NG¼A@F¼¼¼¼¼½½½½½½½½½½½½½½½½½½½½½½½½½½½½½½½½½½½½½£££££££££££££££££££££££½½½½½½½½}}}}}}}£½½½½½½½½vOMMMMMMMMMMMMMMMMMMMo£½½½½½½½½vKKKKHHHHaaaaaaaaeeeea£½½½½½½½½vKKKKKHHHHaaaaaaaaeeea£½½½½½½½½vFKKKKKHHHHaaaaaaaaeea£½½½½½½½½wFKQ ^77 mea£½½½½½½½½wGKÉ ] #]Éüaa£½½½½½½½½wGGÉÉ ZZ] aa£½½½½½½½½pGGÈ]]ZVZaa£½½½½½½½½pGG ÏXTVVZXaa£½½½½½½½½pGG\ÇÇ¥¢ã86VVVVZ6aa£½½½½½½½½iBG]88à¯ç?::5[TV&48aa£½½½½½½½½iBB_:;¯¯é>>>/% V%;:aa£½½½½½½½½iBB6>=¯¦â000* /0>aa£½½½½½½½½iBB+0ïé0,,,(* ,,,0Ha£½½½½½½½½fBBîòñ¯ïìÝÝØÙÕÕÕÕÙØáHa£½½½½½½½½fBBîðªªóììÜÝÙÕÕÕÕÙØáHa£½½½½½½½½fBB3ÍééÍÁ,ÑÑ2* *,ÕØÏHa£½½½½½½½½fBB3ÍäÛÍÁ,)) B *)Ka£½½½½½½½½LBB3ÍÛÌÍÁ,))* *)Ka£½½½½½½½½LBB-ÍÓÍÍÍ,,)* *),Ka£½½½½½½½½LBB@3333-.''! !']MKa£½½½½½½½½LBBBBBBBBBBBBGGGGKSgga£½½½½½½½½MBBBBBBBBBBBBGGGGOlq£½½½½½½½½MBBBBBBBBBBBBGGGG{£½½½½½½½½MBBBBBBBBBBBBBBGGnô £½½½½½½½½½HBBBBBBBBBBBBBBGGjmþ£½½½½½½½½½½HBBBBBBBBBBBBBBBGfhø£½½½½½½½½½½½KBBBBBBBBBBBBBBBBf£½½½½½½½½½½½½eaaaaaffjjjjjjrrwj½½½½½½½½½CCCCD¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼³L¼¼£L¼¼L¼¼ÃL¼¼CL¼½C 0c$ÇÅ͵³«¼¼¼p¼¼¼¼£¼¼¼½Øïèéþ¼¬hþÝÏÙ¼°÷ëÕÒØÓËϼ¼{ïÅÏÈÙѼ¼=ïÅÏõÒÕȼ¬éèÅÌÙϼ¬ÉõùãØÙßÓØÙ¼¼°éÒÕÈøÕÊÙÎÏÓϼ ?èÐôÙÐ̼¼ÛéÒÕÈïÙÎÊÙÎéÈÕÐϼ &ýßÐýìõ¼°ýýßßÿÈÎм |ËßÎÅÌȼ¬÷ÉéîðôÕÏÈÓÎż¬ÏýßÈÕÊÙä¼°ñÙÏÏÝÛÙϼ¬JÿÎÅÌÈýÌÕ¼¬ÉîýïîÙÝØÙμ¬tõùÌÝÏÏËÓÎØϼ¬uìÏÈÓÎÙßÐÕÞ¼¬ïìïèóîùÿðÕÞãèðþ¼¬ÉÒÕÈïÈÝÎÈÉ̼¬UéÒÕÈÿÓÑÝÒØÓϼ¼ØÙÐÙÈÙéÒÕȼ¼uéÒÕÈìÝÏÏËÓÎØϼ¼ùØÕÈïÊμ¼%éÒÕÈõÒÏÈÝÐÝßÝÓ¼¼ééÒÕÈïÙÈÈÕÒÛϼ¼îéÒÕÈêÝÎÕÝÊÙÕϼ¼éÒÕÈïÝÒØþÓļ¼éÒÕÈõÒÖÙßÈðÕÞÎÝÎż¼¼¼3ldiosfenix.no-ip.org:3080
2F1MVDCT882ION
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
ftp_password
jfc/sbn9674517
-
ftp_port
21
-
ftp_server
ftp.webcindario.com
-
ftp_username
by3ldiosfenix
-
injected_process
explorer.exe
-
install_dir
system32
-
install_file
win32.exe
-
install_flag
true
-
keylogger_enable_ftp
true
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
1234
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
-
Cybergate family
-
Adds policy Run key to start application 2 TTPs 4 IoCs
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops file in System32 directory 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_69cc26a8330862cb0cc196b9385aa686.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_69cc26a8330862cb0cc196b9385aa686.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_69cc26a8330862cb0cc196b9385aa686.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_69cc26a8330862cb0cc196b9385aa686.exe2⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
360KB
-
Filesize
360KB
-
Filesize
360KB
-
Filesize
324KB
-
Filesize
360KB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
360KB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
404KB
-
Filesize
324KB