Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
JaffaCakes118_8fbe7ffb8d9b9be8201bdbfc58d2e414
-
Size
372KB
-
Sample
250117-sxbezatmhz
-
MD5
8fbe7ffb8d9b9be8201bdbfc58d2e414
-
SHA1
cbb9c96b03768c6197b1c35e7d318795c6ff8181
-
SHA256
108db342de16bd44b0482a5e586f34e1f5bddf633b42153308f272e82896f67b
-
SHA512
03cb83c83aac852a518ced34b0f69c86af4a5e1185e975b03f65dd21926fe92246314dbeb7fb12399dbdbbf19041fff9b45da3c2c58ab99bf00ee64924c252f2
-
SSDEEP
6144:1MrSUTxm+xVIPCpKpP+gYlo9Hsyn72xrc9puOQykOzSXRNLHrXH:xUTxm+x2CwP+Wx7cu4OQ/tPDrX
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_8fbe7ffb8d9b9be8201bdbfc58d2e414.exe
Resource
win7-20241010-en
Malware Config
Extracted
cybergate
v1.18.0 - Trial version
Owned
trickycore.no-ip.org:1337
56HFRM5CMC0A54
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
install
-
install_file
server.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
13371337
Targets
-
-
Target
JaffaCakes118_8fbe7ffb8d9b9be8201bdbfc58d2e414
-
Size
372KB
-
MD5
8fbe7ffb8d9b9be8201bdbfc58d2e414
-
SHA1
cbb9c96b03768c6197b1c35e7d318795c6ff8181
-
SHA256
108db342de16bd44b0482a5e586f34e1f5bddf633b42153308f272e82896f67b
-
SHA512
03cb83c83aac852a518ced34b0f69c86af4a5e1185e975b03f65dd21926fe92246314dbeb7fb12399dbdbbf19041fff9b45da3c2c58ab99bf00ee64924c252f2
-
SSDEEP
6144:1MrSUTxm+xVIPCpKpP+gYlo9Hsyn72xrc9puOQykOzSXRNLHrXH:xUTxm+x2CwP+Wx7cu4OQ/tPDrX
-
Cybergate family
-
Adds policy Run key to start application
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1