Overview

overview

10

Static

static

10

JaffaCakes...ab.exe

windows7-x64

10

JaffaCakes...ab.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_9a832d07c651cc60629713015f9415ab

  • Size

    281KB

  • MD5

    9a832d07c651cc60629713015f9415ab

  • SHA1

    5963433bad111a6403986bccdc0a5be1e5d481d0

  • SHA256

    2d6b8bd44d37b4821f4d857a1ceaab635824c14ce1567cac28822c5291a573d8

  • SHA512

    22946911cc7374544b75964ac2c0aed35ab472f7d8220260a3c8168fa2d74ca655c612d8696ff65c7dec8703bd4815d876ee6612c2858b8539a934a134919507

  • SSDEEP

    6144:uy+phiTwlTLfkixFUQKf3D7TnBAZ5qhbxM:r+p80lYixsfvDBAzK9M

Score
10/10
solczprotcybergate

Malware Config

Extracted

Family

cybergate

Version

v1.11.0 - Public Version

Botnet

solczprot

C2

foward.no-ip.org:1337

Mutex

B7Y0PP28432E3C

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs

  • ftp_interval

    5

  • injected_process

    svchost.exe

  • install_dir

    AVAST Software\Avast

  • install_file

    Ast1012.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Explorer.exe stopped

  • message_box_title

    Explorer.exe

  • password

    111111

  • regkey_hkcu

    Avast!

  • regkey_hklm

    Avast!

Signatures

  • Cybergate family
    cybergate
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • JaffaCakes118_9a832d07c651cc60629713015f9415ab
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections