Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
JaffaCakes118_77b00e53a3e57be65079ab7adca85d6e
-
Size
293KB
-
Sample
250116-qp1c1stjfl
-
MD5
77b00e53a3e57be65079ab7adca85d6e
-
SHA1
9d438bca1f7e91fbca960717b058270dc2d8e2e3
-
SHA256
29ff725ebb08959167dec6673f9b84daae863caa87dfca381683756bb406995c
-
SHA512
0a359cff248745a64efbee4014ac721e957f97619ce55a74f99ac729f7981892faf40b0fa6b4b2cadef041fda9761481c39d2ef7663f1deb4c53faa1d8454a87
-
SSDEEP
6144:KljwWJyX4mp8D6WGc/YSlIipBReubLzeh7Yy0DMIdeXij0:KljR0oy78QSVnNyhsFMCeSj0
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_77b00e53a3e57be65079ab7adca85d6e.exe
Resource
win7-20241010-en
Malware Config
Extracted
cybergate
v1.18.0 - Crack Version
New
windowsupdatee.sytes.net:1604
UCN4Q8LXQEOTL7
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
WindowsUpdate
-
install_file
update.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
kimokono
Targets
-
-
Target
JaffaCakes118_77b00e53a3e57be65079ab7adca85d6e
-
Size
293KB
-
MD5
77b00e53a3e57be65079ab7adca85d6e
-
SHA1
9d438bca1f7e91fbca960717b058270dc2d8e2e3
-
SHA256
29ff725ebb08959167dec6673f9b84daae863caa87dfca381683756bb406995c
-
SHA512
0a359cff248745a64efbee4014ac721e957f97619ce55a74f99ac729f7981892faf40b0fa6b4b2cadef041fda9761481c39d2ef7663f1deb4c53faa1d8454a87
-
SSDEEP
6144:KljwWJyX4mp8D6WGc/YSlIipBReubLzeh7Yy0DMIdeXij0:KljR0oy78QSVnNyhsFMCeSj0
-
Cybergate family
-
Adds policy Run key to start application
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1